From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Danila Octavian" Subject: Hostname with DNAT ? {OK} Date: Mon, 26 Jul 2004 17:40:12 +0300 Sender: netfilter-admin@lists.netfilter.org Message-ID: <001701c4731e$8408f850$da0da8c0@pisic> Reply-To: "Danila Octavian" Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0010_01C47337.9A91ABD0" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter@lists.netfilter.org This is a multi-part message in MIME format. ------=_NextPart_000_0010_01C47337.9A91ABD0 Content-Type: text/plain; charset="iso-8859-2" Content-Transfer-Encoding: quoted-printable hello, I was wondering if you can guide me how to deal with my situation : I want to do something like :=20 $IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -d mail.server1.com --dport 2= 5 -j DNAT --to 192.168.14.254:25 $IPTABLES -A FORWARD -i eth0 -p tcp -d mail1.server.com --dport 25 -j ACCEPT $IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -d mail.server2.com --dport 2= 5 -j DNAT --to 192.168.14.251:25 $IPTABLES -A FORWARD -i eth0 -p tcp -d mail.server2.com --dport 25 -j ACCEPT $IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -d server3.com --dport 25 -j = DNAT --to 192.168.14.253:25 $IPTABLES -A FORWARD -i eth0 -p tcp -d server3.com --dport 25 -j ACCEPT $IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -d mail.server3.com --dport 2= 5 -j DNAT --to 192.168.14.253:25 $IPTABLES -A FORWARD -i eth0 -p tcp -d mail.server3.com --dport 25 -j ACCEPT Is posibble to use names instead of IP like in my situation ?=20 Thanks in advance --=20 This message has been scanned for viruses and dangerous content, and is believed to be clean. Service.Agress.Ro E-Mail Scanning Service ------=_NextPart_000_0010_01C47337.9A91ABD0 Content-Type: text/html; charset="iso-8859-2" Content-Transfer-Encoding: quoted-printable
hello,
 
I was wondering if you can guide me how to= deal=20 with my situation :
I want to do something like :
 
$IPTABLES -A PREROUTING -t nat -i eth0 -p = tcp -d=20 mail.server1.com --dport 25 -j DNAT --to 192.168.14.254:25
$IPTABLES -A= =20 FORWARD -i eth0 -p tcp -d mail1.server.com --dport 25 -j=20 ACCEPT
 
$IPTABLES -A PREROUTING -t nat -i eth0 -p = tcp -d=20 mail.server2.com --dport 25 -j DNAT --to 192.168.14.251:25
$IPTABLES -A= =20 FORWARD -i eth0 -p tcp -d mail.server2.com --dport 25 -j=20 ACCEPT
 
$IPTABLES -A PREROUTING -t nat -i eth0 -p = tcp -d=20 server3.com --dport 25 -j DNAT --to 192.168.14.253:25
$IPTABLES -A FORWA= RD -i=20 eth0 -p tcp -d server3.com --dport 25 -j ACCEPT
$IPTABLES -A PREROUTING = -t=20 nat -i eth0 -p tcp -d mail.server3.com --dport 25 -j DNAT --to=20 192.168.14.253:25
$IPTABLES -A FORWARD -i eth0 -p tcp -d mail.server3.co= m=20 --dport 25 -j ACCEPT
 
Is posibble to use names instead of IP lik= e in my=20 situation ?
 
Thanks in advance

--=20
This message has been scanned for viruses and
dangerous content, and is believed to be clean.
Service.Agress.Ro E-Mail Sc= anning Service. ------=_NextPart_000_0010_01C47337.9A91ABD0-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Jason Opperisano" Subject: RE: Hostname with DNAT ? {OK} Date: Mon, 26 Jul 2004 11:30:43 -0400 Sender: netfilter-admin@lists.netfilter.org Message-ID: Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: Content-class: urn:content-classes:message Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: Danila Octavian , netfilter@lists.netfilter.org > $IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -d mail.server1.com = --dport 25 -j DNAT --to 192.168.14.254:25 > $IPTABLES -A FORWARD -i eth0 -p tcp -d mail1.server.com --dport 25 -j = ACCEPT > > $IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -d mail.server2.com = --dport 25 -j DNAT --to 192.168.14.251:25 > $IPTABLES -A FORWARD -i eth0 -p tcp -d mail.server2.com --dport 25 -j = ACCEPT > > $IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -d server3.com --dport = 25 -j DNAT --to 192.168.14.253:25 > $IPTABLES -A FORWARD -i eth0 -p tcp -d server3.com --dport 25 -j = ACCEPT > $IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -d mail.server3.com = --dport 25 -j DNAT --to 192.168.14.253:25 > $IPTABLES -A FORWARD -i eth0 -p tcp -d mail.server3.com --dport 25 -j = ACCEPT > > Is posibble to use names instead of IP like in my situation ? using a resolvable hostname instead of an IP in a rule is perfectly = valid. the caveat is: at the time you execute the script, the hostname = is resolved to an IP address and the IP is what ends up in the rule. if = the IP associated with the hostname changes after the rules are = loaded--you must reload the rules for the new IP to be used in the rule. my guess is that the reason you wish to do this is that you have a = dynamic IP address and are using some sort of dynamic DNS service. you = will probably want to incorporate the re-loading of your ruleset into = your DHCP client whenever your IP changes. you could actually do this = without utilizing the "dynamic DNS + hostname in rules" solution by = incorporating something like this into your ruleset: MY_IF=3D"eth0" MY_IP=3D`ip addr sh $MY_IF | grep inet | awk '{print $2}' | cut -d"/" = -f1` $IPTABLES -A PREROUTING -t nat -i $MY_IF -p tcp -d $MY_IP \ --dport 25 -j DNAT --to 192.168.14.251:25 and whenever your IP changes--have the script re-execute to pickup the = new IP. -j From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Danila Octavian" Subject: Re: Hostname with DNAT ? {OK} Date: Tue, 27 Jul 2004 10:54:33 +0300 Sender: netfilter-admin@lists.netfilter.org Message-ID: <007101c473af$108ddc60$da0da8c0@pisic> References: Reply-To: "Danila Octavian" Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: Jason Opperisano , netfilter@lists.netfilter.org I'm afraid i was not very explicit ... I was trying to use strictly names and that's why : I have only one public IP and 3 diferrent names. Behind the machine i have a network with 4 servers which use that names : Internet ---> eth0(public ip) eth1(private ip) ---> mail.server1.com ---> mail.server2.com ---> mail.server3.com $IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -d mail.server1.com --dport 25 -j DNAT --to 192.168.14.254:25 $IPTABLES -A FORWARD -i eth0 -p tcp -d mail1.server.com --dport 25 -j ACCEPT $IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -d mail.server2.com --dport 25 -j DNAT --to 192.168.14.251:25 $IPTABLES -A FORWARD -i eth0 -p tcp -d mail.server2.com --dport 25 -j ACCEPT $IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -d mail.server3.com --dport 25 -j DNAT --to 192.168.14.253:25 $IPTABLES -A FORWARD -i eth0 -p tcp -d mail.server3.com --dport 25 -j ACCEPT I realized that iptables uses the resolved IP address but that's exactly what i was trying to avoid. Can that be possible ? Thanks very much in advance, Danila Octavian -- This message has been scanned for viruses and dangerous content, and is believed to be clean. Service.Agress.Ro E-Mail Scanning Service From mboxrd@z Thu Jan 1 00:00:00 1970 From: Antony Stone Subject: Re: Hostname with DNAT ? {OK} Date: Tue, 27 Jul 2004 09:44:52 +0100 Sender: netfilter-admin@lists.netfilter.org Message-ID: <200407270944.52819.Antony@Soft-Solutions.co.uk> References: <007101c473af$108ddc60$da0da8c0@pisic> Reply-To: Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Return-path: In-Reply-To: <007101c473af$108ddc60$da0da8c0@pisic> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.netfilter.org On Tuesday 27 July 2004 8:54 am, Danila Octavian wrote: > I'm afraid i was not very explicit ... > > I was trying to use strictly names and that's why : > > I have only one public IP and 3 diferrent names. Behind the machine i have > a network with 4 servers which use that names : In that case set up one mail relay (which only accepts mail for the four domains), feed all external MX records to this one server, and then configure it to relay mail for each domain on to each appropriate server. What you are trying to do is an application layer requirement; netfilter cannot do this for you at the network routing layer. Regards, Antony. -- I love deadlines. I love the whooshing noise they make as they go by. - Douglas Noel Adams Please reply to the list; please don't CC me. From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Bruno Negrao" Subject: Re: Hostname with DNAT ? {OK} Date: Tue, 27 Jul 2004 11:16:53 -0300 Sender: netfilter-admin@lists.netfilter.org Message-ID: <011401c473e4$5db3d1e0$5100a8c0@egp> References: <001701c4731e$8408f850$da0da8c0@pisic> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0111_01C473CB.382D6170" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: Danila Octavian , netfilter@lists.netfilter.org This is a multi-part message in MIME format. ------=_NextPart_000_0111_01C473CB.382D6170 Content-Type: text/plain; charset="iso-8859-2" Content-Transfer-Encoding: quoted-printable Hi Danila, there are some error in your rules, first i'll correct them, = then i'll tell you about using names ----- Original Message -----=20 From: Danila Octavian=20 To: netfilter@lists.netfilter.org=20 Sent: Monday, July 26, 2004 11:40 AM Subject: Hostname with DNAT ? {OK} hello, I was wondering if you can guide me how to deal with my situation : I want to do something like :=20 read carefully this rule: $IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -d mail.server1.com = --dport 25 -j DNAT --to 192.168.14.254:25 From now on, when the packet arrives the FORWARD chain of the filter = table, it is not destinated to mail.server1.com anymore, since you have = just changed its destination IP with the rule above. it is destined to = 192.168.14.254. the '-d IP' in the rule bellow is wrong: $IPTABLES -A FORWARD -i eth0 -p tcp -d mail1.server.com --dport 25 -j = ACCEPT You should write instead: $IPTABLES -A FORWARD -i eth0 -p tcp -d 192.168.14.254 --dport 25 -j = ACCEPT did you got it? This applies for all these rules bellow: $IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -d mail.server2.com = --dport 25 -j DNAT --to 192.168.14.251:25 $IPTABLES -A FORWARD -i eth0 -p tcp -d mail.server2.com(wrong) --dport = 25 -j ACCEPT $IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -d server3.com --dport = 25 -j DNAT --to 192.168.14.253:25 $IPTABLES -A FORWARD -i eth0 -p tcp -d server3.com(wrong) --dport 25 = -j ACCEPT $IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -d mail.server3.com = --dport 25 -j DNAT --to 192.168.14.253:25 $IPTABLES -A FORWARD -i eth0 -p tcp -d mail.server3.com(wrong) --dport = 25 -j ACCEPT Is posibble to use names instead of IP like in my situation ?=20 Yes, it is *possible*. It depends of whether your firewall can access = the DNS server when it is loading those rules. In my firewall, when it is loading the PREROUTING rules, it didn't = load the INPUT and OUTPUT rules yet, so it is not permitted to send nor = receive any packet, so it can't contact the DNS server to resolve names. In my firewall I just load the FORWARD rules after i have loaded the = INPUT and OUTPUT chains, so my firewall already can access the DNS = server. hope it helps, bruno ------=_NextPart_000_0111_01C473CB.382D6170 Content-Type: text/html; charset="iso-8859-2" Content-Transfer-Encoding: quoted-printable
Hi Danila, there are some error in your = rules,=20 first i'll correct them, then i'll tell you about using = names
----- Original Message -----
From:=20 Danila Octavian
To: netfilter@lists.netfilter.o= rg=20
Sent: Monday, July 26, 2004 = 11:40=20 AM
Subject: Hostname with DNAT ? = {OK}

hello,
 
I was wondering if you can guide me = how to deal=20 with my situation :
I want to do something like : =
 
read carefully this=20 rule:
$IPTABLES -A PREROUTING -t nat -i = eth0 -p tcp -d=20 mail.server1.com --dport 25 -j DNAT --to = 192.168.14.254:25
From now on, = when the packet=20 arrives the FORWARD chain of the filter table, it is not = destinated to=20 mail.server1.com anymore, since you have just changed its destination IP with the rule = above. it=20 is destined to 192.168.14.254.
the '-d IP' in = the rule=20 bellow is wrong:
$IPTABLES -A FORWARD -i eth0 -p tcp=20 -d mail1.server.com --dport 25 -j ACCEPT
You should write=20 instead:
$IPTABLES -A FORWARD = -i eth0 -p tcp=20 -d 192.168.14.254 --dport 25 -j ACCEPT
 
did you got = it?
This applies for all = these rules=20 bellow:
 
$IPTABLES -A PREROUTING -t nat -i = eth0 -p tcp -d=20 mail.server2.com --dport 25 -j DNAT --to = 192.168.14.251:25
$IPTABLES -A=20 FORWARD -i eth0 -p tcp -d mail.server2.com(wrong)
--dport 25 -j ACCEPT
$IPTABLES -A PREROUTING -t nat -i = eth0 -p tcp -d=20 server3.com --dport 25 -j DNAT --to 192.168.14.253:25
$IPTABLES -A = FORWARD=20 -i eth0 -p tcp -d server3.com(wrong) = --dport 25 -j=20 ACCEPT
$IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -d = mail.server3.com=20 --dport 25 -j DNAT --to 192.168.14.253:25
$IPTABLES -A FORWARD -i = eth0 -p=20 tcp -d mail.server3.com(wrong) --dport 25 = -j=20 ACCEPT
 
Is posibble to use names instead of = IP like in my=20 situation ?
Yes, it is = *possible*. It=20 depends of whether your firewall can access the DNS server when = it is=20 loading those rules.
In my firewall, when = it is loading=20 the PREROUTING rules, it didn't load the INPUT and OUTPUT rules yet, = so it is=20 not permitted to send nor receive any packet, so it can't contact the = DNS=20 server to resolve names.
 
In my firewall I just = load the=20 FORWARD rules after i have loaded the INPUT and OUTPUT chains, so my = firewall=20 already can access the DNS server.
 
hope it = helps,
bruno
------=_NextPart_000_0111_01C473CB.382D6170-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Danila Octavian" Subject: Re: Hostname with DNAT ? {OK} Date: Wed, 28 Jul 2004 09:18:14 +0300 Sender: netfilter-admin@lists.netfilter.org Message-ID: <016b01c4746a$be09df90$da0da8c0@pisic> References: <001701c4731e$8408f850$da0da8c0@pisic> <011401c473e4$5db3d1e0$5100a8c0@egp> Reply-To: "Danila Octavian" Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0168_01C47483.CF5CA6B0" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: Bruno Negrao Cc: netfilter@lists.netfilter.org This is a multi-part message in MIME format. ------=_NextPart_000_0168_01C47483.CF5CA6B0 Content-Type: text/plain; charset="iso-8859-2" Content-Transfer-Encoding: quoted-printable Hi Danila, there are some error in your rules, first i'll correct them, t= hen i'll tell you about using names I know the rules were wrong ... i was in a rush ... u are right, but i wa= s trying to do something else. I will give my setup just to see what i was = asking : internet ---> public ip eth0 eth1 private ip --> mail.server1.com private= ip eth0 eth1 private ip ---> lan --> mail.serve= r2.com private ip eth0 eth1 private ip ---> lan --> mail.serve= r3.com private ip eth0 eth1 private ip ---> lan=20=20 The problem is that i have 3 names on the same public IP and i want to se= nd mail traffic to those servers which have private ips. I don't want to use smtp on the router with public ip , just redirrect na= me based to the machines behind accordingly. thank you very much for your help, Danila Octavian=20 ----- Original Message -----=20 From: Danila Octavian=20 To: netfilter@lists.netfilter.org=20 Sent: Monday, July 26, 2004 11:40 AM Subject: Hostname with DNAT ? {OK} hello, I was wondering if you can guide me how to deal with my situation : I want to do something like :=20 read carefully this rule: $IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -d mail.server1.com --dpo= rt 25 -j DNAT --to 192.168.14.254:25 From now on, when the packet arrives the FORWARD chain of the filter ta= ble, it is not destinated to mail.server1.com anymore, since you have just = changed its destination IP with the rule above. it is destined to 192.168.1= 4.254. the '-d IP' in the rule bellow is wrong: $IPTABLES -A FORWARD -i eth0 -p tcp -d mail1.server.com --dport 25 -j A= CCEPT You should write instead: $IPTABLES -A FORWARD -i eth0 -p tcp -d 192.168.14.254 --dport 25 -j ACC= EPT did you got it? This applies for all these rules bellow: $IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -d mail.server2.com --dpo= rt 25 -j DNAT --to 192.168.14.251:25 $IPTABLES -A FORWARD -i eth0 -p tcp -d mail.server2.com(wrong) --dport = 25 -j ACCEPT $IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -d server3.com --dport 25= -j DNAT --to 192.168.14.253:25 $IPTABLES -A FORWARD -i eth0 -p tcp -d server3.com(wrong) --dport 25 -j= ACCEPT $IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -d mail.server3.com --dpo= rt 25 -j DNAT --to 192.168.14.253:25 $IPTABLES -A FORWARD -i eth0 -p tcp -d mail.server3.com(wrong) --dport = 25 -j ACCEPT Is posibble to use names instead of IP like in my situation ?=20 Yes, it is *possible*. It depends of whether your firewall can access t= he DNS server when it is loading those rules. In my firewall, when it is loading the PREROUTING rules, it didn't load= the INPUT and OUTPUT rules yet, so it is not permitted to send nor receive= any packet, so it can't contact the DNS server to resolve names. In my firewall I just load the FORWARD rules after i have loaded the IN= PUT and OUTPUT chains, so my firewall already can access the DNS server. hope it helps, bruno --=20 This message has been scanned for viruses and=20 dangerous content, and is believed to be clean.=20 Service.Agress.Ro E-Mail Scanning Service.=20 --=20 This message has been scanned for viruses and dangerous content, and is believed to be clean. Service.Agress.Ro E-Mail Scanning Service ------=_NextPart_000_0168_01C47483.CF5CA6B0 Content-Type: text/html; charset="iso-8859-2" Content-Transfer-Encoding: quoted-printable
 
Hi Danila, there are some error in your = rules,=20 first i'll correct them, then i'll tell you about using names
 
I know the rules were wrong ... i was in= a rush=20 ... u are right, but i was trying to do something else. I will give my se= tup=20 just to see what i was asking :
 
internet ---> public ip eth0 eth1 pri= vate ip=20 --> mail.server1.com private ip eth0 eth1 private ip --->=20 lan
          &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;         =20 --> mail.server2.com private ip eth0 eth1 private ip --->=20 lan
          &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;          -->&nbs= p;mail.server3.com=20 private ip eth0 eth1 private ip ---> lan 
The problem is that i have 3 names on th= e same=20 public IP and i want to send mail traffic to those servers which have pri= vate=20 ips.
I don't want to use smtp on the router w= ith=20 public ip , just redirrect name based to the machines behind=20 accordingly.
thank you very much for your help,
 
Danila Octavian 
----- Original Message -----
F= rom:=20 Danila Octavian
To: netfilter@lists.netfilter= .org=20
Sent: Monday, July 26, 2004 11:4= 0=20 AM
Subject: Hostname with DNAT ?=20 {OK}

hello,
 
I was wondering if you can guide me ho= w to deal=20 with my situation :
I want to do something like : <= /DIV>
 
read carefully this=20 rule:
$IPTABLES -A PREROUTING -t nat -i eth0= -p tcp=20 -d mail.server1.com --dport 25 -j DNAT --to 192.168.14.254:25
From now on, whe= n the=20 packet arrives the FORWARD chain of the filter table, it is not=20 destinated to mail.server1.com anymore, since you have just changed its destination IP= with the=20 rule above. it is destined to 192.168.14.254.
the '-d IP' in t= he rule=20 bellow is wrong:
$IPTABLES -A FORWARD -i eth0 -p tcp=20 -d mail1.server.com --dport 25 -j ACCEPT
You should write=20 instead:
$IPTABLES -A FORWARD -= i eth0 -p=20 tcp -d 192.168.14.254 --dport 25 -j ACCEPT
 
did you got it?=
This applies for all t= hese rules=20 bellow:
 
$IPTABLES -A PREROUTING -t nat -i eth0= -p tcp=20 -d mail.server2.com --dport 25 -j DNAT --to 192.168.14.251:25
$IPTAB= LES=20 -A FORWARD -i eth0 -p tcp -d mail.server2.com(wrong)
--dport 25 -j ACCEPT
$IPTABLES -A PREROUTING -t nat -i eth0= -p tcp=20 -d server3.com --dport 25 -j DNAT --to 192.168.14.253:25
$IPTABLES -= A=20 FORWARD -i eth0 -p tcp -d server3.com(wrong)=20 --dport 25 -j ACCEPT
$IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -= d=20 mail.server3.com --dport 25 -j DNAT --to 192.168.14.253:25
$IPTABLES= -A=20 FORWARD -i eth0 -p tcp -d mail.server3.com(wrong)= =20 --dport 25 -j ACCEPT
 
Is posibble to use names instead of IP= like in=20 my situation ?
Yes, it is *possible*.= It=20 depends of whether your firewall can access the DNS server when it= is=20 loading those rules.
In my firewall, when i= t is=20 loading the PREROUTING rules, it didn't load the INPUT and OUTPUT rules= yet,=20 so it is not permitted to send nor receive any packet, so it can't cont= act=20 the DNS server to resolve names.
 
In my firewall I just = load the=20 FORWARD rules after i have loaded the INPUT and OUTPUT chains, so my=20 firewall already can access the DNS server.
 
hope it helps,<= /DIV>
bruno

--
This message has been = scanned=20 for viruses and
dangerous content, and is believed to be clean.
<= A=20 href=3D"http://service.agress.ro/">Service.Agress.Ro E-Mail Scanning= =20 Service.
--=20
This message has been scanned for viruses and
dangerous content, and is believed to be clean.
Service.Agress.Ro E-Mail Sc= anning Service. ------=_NextPart_000_0168_01C47483.CF5CA6B0--