From mboxrd@z Thu Jan 1 00:00:00 1970 From: Antony Stone Subject: Re: Packet forwarding. Date: Wed, 7 Apr 2004 18:37:29 +0100 Sender: netfilter-admin@lists.netfilter.org Message-ID: <200404071837.29160.Antony@Soft-Solutions.co.uk> References: <1081357206.4074339639b86@mail.tscnet.net> <200404071814.34654.Antony@Soft-Solutions.co.uk> <1081358721.40743981919b2@mail.tscnet.net> Reply-To: netfilter@lists.netfilter.org Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Return-path: In-Reply-To: <1081358721.40743981919b2@mail.tscnet.net> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.netfilter.org On Wednesday 07 April 2004 6:25 pm, bdameron@tscnet.net wrote: > > If you tell us what your rules are and give us some more detail about > > your network setup, we might be able to help, however a better solution > > for you is to look at some of the excellent documentation available to > > learn how to do it yourself. This is not a hard problem, and you will be > > able to manage your system much better in future if you understand more > > about how it works. > > > > One very important detail which is not clear from your description above > > is: where is the "client machine" located? > > Client machine being anyone from the outside world. And I have looked > over some of the documentation. Basically there is no current firewall > policies. Just want anything coming in on xxx.xxx.xxx.xxx:443 (Internet > Machine) to be routed to 10.10.1.110:443 (Internal Lan Machine). > > Looks like I need to mangle the packet header so that the Lan machine thinks > that the Internet machine is sending the packet and then have the Internet > machine redirect the packet to the client. Client again being someone on the > Internet. Not sure if this can be done or not. Correct me if I am wrong. With all due respect, yes, you are very wrong. This is a simple "nat + forward" situation. Since you haven't said what your ruleset is, I shall assume none, and give you an example of how to make work what you have asked for: iptables -F iptables -F -t nat iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -i eth0 -p tcp --dport 443 -d 10.10.1.110 -j ACCEPT iptables -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to 10.10.1.110 If eth0 is not your external interface then change it in the above two rules for whatever your external interface is. Regards, Antony. -- Abandon hope, all ye who enter here. You'll feel much better about things once you do. Please reply to the list; please don't CC me.