From: Andrew Beverley <andy@andybev.com>
To: mabra@manfbraun.de
Cc: netfilter@vger.kernel.org
Subject: RE: IPTABLES:Let external address appear as an internal address
Date: Sat, 01 Sep 2012 16:14:54 +0100 [thread overview]
Message-ID: <1346512494.2141.16.camel@andylaptop> (raw)
In-Reply-To: <!&!AAAAAAAAAAAYAAAAAAAAAOosgHnoPqdNlUO2DUrQ/DfCgAAAEAAAACyt4OZhXX9Ijc6HtHJdLrMBAAAAAA==@manfbraun.de>
On Sat, 2012-09-01 at 01:05 +0200, mabra@manfbraun.de wrote:
> I studied the diagrams over and over and over again [Although , there
> are different schemas on the net, the last I've used, was on
> wikipedia].
I assume you mean this one[1]. That is the most accurate, although it
might be a bit too detailed for a beginner.
> What you said, comes to my mind, but I am not sure,
> because, what is a "local process"
A process running on the same machine that iptables is running on.
Packets to/from the local process will go via the INPUT/OUTPUT chains
instead of FORWARD.
> is not quit clear in the diagram and
> the diagram has even not the usual LO interface, which is alway present
> too.
The local interface is like a normal physical interface, so can be
treated as such when looking at the packet flow diagram. If you're
accessing a local process through lo, then packets will come in from lo,
travel through INPUT, and be received by the local process. Return
packets generated by the process will be returned via OUTPUT back to the
lo interface.
> Yes, the monit daemon runs on the firewall machine with the iptables.
In which case you cannot use POSTROUTING to alter packets destined to
it.
> Even the internal web cannot be used on the local machine,
There is no technical reason that it cannot.
> This is not working [both, curl and wget
> say me: connection refused].
In which case either the daemon is refusing the connection or the
packets are being rejected by an iptables rule.
> Seems to be the same
> issue.
Same issue as what?
> I am working on this for about three day now and I am out of hope.
What exactly are you trying to achieve? I have not used monit, but I
would be surprised if you have to translate addresses and ports to make
it work how you want it to.
P.S. I recommend a better email client than MS Outlook if you want to
partake in mailing lists. This will allow you to perform proper quoting
when replying :-)
Andy
[1]
http://upload.wikimedia.org/wikipedia/commons/3/37/Netfilter-packet-flow.svg
next prev parent reply other threads:[~2012-09-01 15:14 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-08-31 11:11 IPTABLES:Let external address appear as an internal address mabra
2012-08-31 17:36 ` Andrew Beverley
2012-08-31 23:05 ` mabra
2012-09-01 15:14 ` Andrew Beverley [this message]
2012-09-02 11:48 ` mabra
2012-09-02 13:25 ` Andrew Beverley
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1346512494.2141.16.camel@andylaptop \
--to=andy@andybev.com \
--cc=mabra@manfbraun.de \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox