From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Rob Sterenborg" Subject: RE: port forwarding in a web server Date: Mon, 24 Nov 2003 18:11:06 +0100 Sender: netfilter-admin@lists.netfilter.org Message-ID: <20031124171108.6D4DC8047@sterenborg.info> References: <1069690404.1083.15.camel@webmail.aeropostal.com.ve> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <1069690404.1083.15.camel@webmail.aeropostal.com.ve> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: 'Lista de netfilter' > simple. Here's my scenario: I have a static IP address routed > (1.1.1.1) > to one server using a 192.168.0.* address. Is a cisco router and > everything works fine. This server has 192.168.0.1 as it's address and So I can assume that *ALL* traffic is routed from 1.1.1.1 to 192.168.0.1, which has Netfilter running ? > functions as a web server, everything works fine but, I have another > server that works as our mail server that is using 192.168.0.2. I've > been trying to redirect everything coming from port 25 to my > mail server > but it doesn't get any answer. These are the rules I've been using: echo 0 > /proc/sys/net/ipv4/ip_forward iptables -P FORWARD DROP iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -A FORWARD -d 192.168.0.2 -p tcp --dport 25 -j ACCEPT iptables -t nat -A PREROUTING -d 192.168.0.1 -p tcp --dport 25 \ -j DNAT --to-destination 192.168.0.2:25 echo 1 > /proc/sys/net/ipv4/ip_forward If you're forwarding anything else than just smtp, you have to add rules to allow it : these rules DROP all traffic to be forwarded except smtp which is DNAT-ed to the MTA and RELATED/ESTABLISHED traffic. Gr, Rob