From mboxrd@z Thu Jan 1 00:00:00 1970 From: test@seaconindia.com Subject: Re: DNAT Problem Date: Thu, 22 Apr 2004 23:48:10 +0530 (IST) Sender: netfilter-admin@lists.netfilter.org Message-ID: <13723.80.0.0.2.1082657890.squirrel@202.149.196.178> References: <1611.80.0.0.23.1082351242.squirrel@80.0.0.175> <200404221347.13412.Antony@Soft-Solutions.co.uk> <1645.80.0.0.23.1082639169.squirrel@80.0.0.175> <200404221421.44015.Antony@Soft-Solutions.co.uk> Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Return-path: In-Reply-To: <200404221421.44015.Antony@Soft-Solutions.co.uk> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.netfilter.org Hi Antony >> >> I have email server running behind my firewall. Now all request >> coming >> >> from internet are logged as if coming from my firewall. I want the >> >> request to be logged with source ip and not with firewall ip. >> > >> > I know that is your problem. >> > >> > I believe the change to your MASQUERADE / SNAT rule which I posted is >> a >> > solution to that problem. >> > >> > If it is not a solution, then post your current ruleset so that we can >> > think about it further. >> >> iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 25 -j DNAT --to >> 192.168.0.6:25 > > I don't believe that can be your complete ruleset. > > I see nothing wrong with the above rule as it stands, however on its own > it's > not much good - you need a FORWARD rule to allow packets through to the > mail > server as well. > Can you give me an example of the forward rule set. > Anyway, I thought (I may be mistaken) that the problem was not with the > inbound DNAT, but with SNAT? > Or shall I attach my complete bash script ? (is it ok ?) Regards Joel