Re: routing external IP's to internal machines.... Confustion

[Sheldon Hearn <sheldonh@starjuice.net>]

On Thu, 2004-06-10 at 00:43, Michael Rowley MD wrote:

> I have a block of IP's from Sprint, 209.26.244.33/29.  I have 2 servers 
> inside the firewall that I would like to have accessible from the 
> internet on an external fixed IP.  Currently the internal network is on 
> 192.168.1.0/24, the firewall is working, and I can ssh into the 
> firewall, but would like to ssh into all the servers, and need web 
> access to both also.  I will try and diagram this, just to ellucidate. 

Do source nat and destination nat in both PREROUTING and POSTROUTING,
ignoring the interface on which the packets are seen.  E.g.

-A PREROUTING -j dst-nat
-A POSTROUTING -j src-nat
-A dst-nat -d 209.26.244.33 -j DNAT --to-destination 192.168.1.33
...
-A src-nat -s 192.168.1.33 -j SNAT --to-source 209.26.244.33
...

This assumes that you don't want to set up a DNS server that gives
"fake" answers to clients on 192.168.1.0/24.

Both approaches work for me.  YMMV.

Ciao,
Sheldon.