From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Bruno Negrao" Subject: Re: Hostname with DNAT ? {OK} Date: Tue, 27 Jul 2004 11:16:53 -0300 Sender: netfilter-admin@lists.netfilter.org Message-ID: <011401c473e4$5db3d1e0$5100a8c0@egp> References: <001701c4731e$8408f850$da0da8c0@pisic> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0111_01C473CB.382D6170" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: Danila Octavian , netfilter@lists.netfilter.org This is a multi-part message in MIME format. ------=_NextPart_000_0111_01C473CB.382D6170 Content-Type: text/plain; charset="iso-8859-2" Content-Transfer-Encoding: quoted-printable Hi Danila, there are some error in your rules, first i'll correct them, = then i'll tell you about using names ----- Original Message -----=20 From: Danila Octavian=20 To: netfilter@lists.netfilter.org=20 Sent: Monday, July 26, 2004 11:40 AM Subject: Hostname with DNAT ? {OK} hello, I was wondering if you can guide me how to deal with my situation : I want to do something like :=20 read carefully this rule: $IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -d mail.server1.com = --dport 25 -j DNAT --to 192.168.14.254:25 From now on, when the packet arrives the FORWARD chain of the filter = table, it is not destinated to mail.server1.com anymore, since you have = just changed its destination IP with the rule above. it is destined to = 192.168.14.254. the '-d IP' in the rule bellow is wrong: $IPTABLES -A FORWARD -i eth0 -p tcp -d mail1.server.com --dport 25 -j = ACCEPT You should write instead: $IPTABLES -A FORWARD -i eth0 -p tcp -d 192.168.14.254 --dport 25 -j = ACCEPT did you got it? This applies for all these rules bellow: $IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -d mail.server2.com = --dport 25 -j DNAT --to 192.168.14.251:25 $IPTABLES -A FORWARD -i eth0 -p tcp -d mail.server2.com(wrong) --dport = 25 -j ACCEPT $IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -d server3.com --dport = 25 -j DNAT --to 192.168.14.253:25 $IPTABLES -A FORWARD -i eth0 -p tcp -d server3.com(wrong) --dport 25 = -j ACCEPT $IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -d mail.server3.com = --dport 25 -j DNAT --to 192.168.14.253:25 $IPTABLES -A FORWARD -i eth0 -p tcp -d mail.server3.com(wrong) --dport = 25 -j ACCEPT Is posibble to use names instead of IP like in my situation ?=20 Yes, it is *possible*. It depends of whether your firewall can access = the DNS server when it is loading those rules. In my firewall, when it is loading the PREROUTING rules, it didn't = load the INPUT and OUTPUT rules yet, so it is not permitted to send nor = receive any packet, so it can't contact the DNS server to resolve names. In my firewall I just load the FORWARD rules after i have loaded the = INPUT and OUTPUT chains, so my firewall already can access the DNS = server. hope it helps, bruno ------=_NextPart_000_0111_01C473CB.382D6170 Content-Type: text/html; charset="iso-8859-2" Content-Transfer-Encoding: quoted-printable
Hi Danila, there are some error in your = rules,=20 first i'll correct them, then i'll tell you about using = names
----- Original Message -----
From:=20 Danila Octavian
To: netfilter@lists.netfilter.o= rg=20
Sent: Monday, July 26, 2004 = 11:40=20 AM
Subject: Hostname with DNAT ? = {OK}

hello,
 
I was wondering if you can guide me = how to deal=20 with my situation :
I want to do something like : =
 
read carefully this=20 rule:
$IPTABLES -A PREROUTING -t nat -i = eth0 -p tcp -d=20 mail.server1.com --dport 25 -j DNAT --to = 192.168.14.254:25
From now on, = when the packet=20 arrives the FORWARD chain of the filter table, it is not = destinated to=20 mail.server1.com anymore, since you have just changed its destination IP with the rule = above. it=20 is destined to 192.168.14.254.
the '-d IP' in = the rule=20 bellow is wrong:
$IPTABLES -A FORWARD -i eth0 -p tcp=20 -d mail1.server.com --dport 25 -j ACCEPT
You should write=20 instead:
$IPTABLES -A FORWARD = -i eth0 -p tcp=20 -d 192.168.14.254 --dport 25 -j ACCEPT
 
did you got = it?
This applies for all = these rules=20 bellow:
 
$IPTABLES -A PREROUTING -t nat -i = eth0 -p tcp -d=20 mail.server2.com --dport 25 -j DNAT --to = 192.168.14.251:25
$IPTABLES -A=20 FORWARD -i eth0 -p tcp -d mail.server2.com(wrong) --dport 25 -j ACCEPT
$IPTABLES -A PREROUTING -t nat -i = eth0 -p tcp -d=20 server3.com --dport 25 -j DNAT --to 192.168.14.253:25
$IPTABLES -A = FORWARD=20 -i eth0 -p tcp -d server3.com(wrong) = --dport 25 -j=20 ACCEPT
$IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -d = mail.server3.com=20 --dport 25 -j DNAT --to 192.168.14.253:25
$IPTABLES -A FORWARD -i = eth0 -p=20 tcp -d mail.server3.com(wrong) --dport 25 = -j=20 ACCEPT
 
Is posibble to use names instead of = IP like in my=20 situation ?
Yes, it is = *possible*. It=20 depends of whether your firewall can access the DNS server when = it is=20 loading those rules.
In my firewall, when = it is loading=20 the PREROUTING rules, it didn't load the INPUT and OUTPUT rules yet, = so it is=20 not permitted to send nor receive any packet, so it can't contact the = DNS=20 server to resolve names.
 
In my firewall I just = load the=20 FORWARD rules after i have loaded the INPUT and OUTPUT chains, so my = firewall=20 already can access the DNS server.
 
hope it = helps,
bruno
------=_NextPart_000_0111_01C473CB.382D6170--