Re: Nat

[Antony Stone <Antony@Soft-Solutions.co.uk>]

On Sunday 08 September 2002 9:43 pm, Mattia Martinello wrote:

> Hi.
>
> I wish to create a nat with masquerading to allow my LAN to access to
> Internet.
> I have two LANs: 192.168.1.x and 192.168.2.x. The server wich will make
> the masquerading has both two LANs with two ethernet card.
> How I can allow only one LAN to access Internet with ppp0 on the server?
> I tried these lines, but it doesn't work:
>
> iptables -t nat -F POSTROUTING
> iptables -t nat -A POSTROUTING -j DROP

Never, never set a default policy other than ACCEPT on the nat or mangle 
tables !

> iptables -t nat -A POSTROUTING -s 192.168.1.0/255.255.255.0 -o ppp0 -j
> MASQUERADE

That should work fine.   A pity you can't use the -i option to specify the 
input interface in the POSTROUTING chain, but there you go....

> What I can do?

You could alternatively filter out packets from 192.168.2.0/24 going to ppp0, 
and then just MASQUERADE everything exiting ppp0 ?

Antony.

-- 

It is also possible that putting the birds in a laboratory setting
inadvertently renders them relatively incompetent.

 - Daniel C Dennett