Re: port forwarding not working

[Antony Stone <Antony@Soft-Solutions.co.uk>]

On Thursday 15 April 2004 3:28 pm, Alexander Economou wrote:

> If i understood well , you have a linux firewall with a dmz ip and you
> want to redirect traffic from a real ip to lan ip of your network.If i am
> correct then you should do :
>
> iptables -t nat -F
> iptables -t nat -A POSTROUTING -o dmzinterface -j MASQUERADE

I disagree with this rule.   It will make all connections to servers in the 
DMZ network appear to come from the firewall, which will destroy any useful 
logging on the services which are running.

> iptables -t nat -A PREROUTING -p tcp -d dmzip --dport 6181 -j DNAT --to
> lanip:6181
> iptables -t nat -A PREROUTING -p tcp -d dmzip --dport 6182 -j DNAT --to
> lanip:6182
> etc etc

It's important to remember that in addition to the PREROUTING rules to do the 
address translation, you need FORWARDign rules to allow the now-translated 
packets through the firewall.   It was the FORWARDing rules which were the 
problem in Nick's script.

Regards,

Antony.

-- 
Wanted: telepath.   You know where to apply.

                                                     Please reply to the list;
                                                           please don't CC me.