Re: Packet forwarding.

[Antony Stone <Antony@Soft-Solutions.co.uk>]

On Wednesday 07 April 2004 6:25 pm, bdameron@tscnet.net wrote:

> > If you tell us what your rules are and give us some more detail about
> > your network setup, we might be able to help, however a better solution
> > for you is to look at some of the excellent documentation available to
> > learn how to do it yourself.   This is not a hard problem, and you will be
> > able to manage your system much better in future if you understand more
> > about how it works.
> >
> > One very important detail which is not clear from your description above
> > is: where is the "client machine" located?
>
>   Client machine being anyone from the outside world. And I have looked
> over some of the documentation. Basically there is no current firewall
> policies. Just want anything coming in on xxx.xxx.xxx.xxx:443 (Internet
> Machine) to be routed to 10.10.1.110:443 (Internal Lan Machine).
>
> Looks like I need to mangle the packet header so that the Lan machine thinks
> that the Internet machine is sending the packet and then have the Internet
> machine redirect the packet to the client. Client again being someone on the
> Internet. Not sure if this can be done or not. Correct me if I am wrong.

With all due respect, yes, you are very wrong.   This is a simple "nat + 
forward" situation.

Since you haven't said what your ruleset is, I shall assume none, and give you 
an example of how to make work what you have asked for:

iptables -F
iptables -F -t nat
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i eth0 -p tcp --dport 443 -d 10.10.1.110 -j ACCEPT
iptables -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to 10.10.1.110

If eth0 is not your external interface then change it in the above two rules 
for whatever your external interface is.

Regards,

Antony.

-- 
Abandon hope, all ye who enter here.
You'll feel much better about things once you do.

                                                     Please reply to the list;
                                                           please don't CC me.