Re: Forwarding packets over the same LAN

[Simion Onea <simionea@gmail.com>]

On Wed, 2009-07-15 at 16:12 -0400, Mike Williams wrote:
> Simon,
> 
> Hi there.  Would you mind posting the output of iptables-save?  After
> reading about your battle with this it would be nice to see the
> complete set of working rules.  Also, having the final solution in the
> archives may help someone else.
> 
> Thanks,
> 
> Mike

Hi Mike!

Well, our set of iptables rules is rather large. It performs several
tasks like blocking access to some ports on the server, blocking access
to some hosts, performing NAT for other hosts, etc.
To be useful for the community, this set of rules would require a
detailed explanation which I am not prepared to give because our
company's policies do not allow me to do so.
But the solution to my problem were the couple of rules proposed by
Thomas Jacob:
> On Mon, 2009-07-13 at 16:14 +0200, Thomas Jacob wrote:
> > You need DNAT+SNAT for this:
> > 
> > # Redirect to IP:Port
> > iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 10025 \
> >      -j DNAT --to-destination 172.20.1.254:25
> > 
> > # Ensure that the replies come back to us
> > iptables -t nat -A POSTROUTING -o eth0 -p tcp --dport 25 \
> >          -d 172.20.1.254  -j SNAT --to-source 172.20.1.245

These rules did the job, but there was another one that I didn't notice
at first. This rule was blocking traffic to port 25:

# iptables -A FORWARD -p tcp -s 172.20.1.245 -d 0/0 --dport 25 -j DROP

As soon as I removed this rule everything went fine.

Regards,
Simion.