Re: Re - NAT to client

[Jason Opperisano <opie@817west.com>]

On Fri, Apr 29, 2005 at 07:13:37PM +0500, varun_saa@vsnl.net wrote:
> >> # Generated by iptables-save v1.2.9 on Tue Apr 26 14:50:01 2005
> >> *nat
> >> :OUTPUT ACCEPT [0:0]
> >> :PREROUTING ACCEPT [0:0]
> >> :POSTROUTING ACCEPT [0:0]
> >> -A POSTROUTING -o eth0 -j MASQUERADE
> 
> so you MASQ all outbound traffic
> 
> Well should I or not.

that's the only question you have from my post?

> I have a static IP and my subnets are
> 
> 192.168.0.0/24
> 
> 192.168.21.0/24
> 
> Is it possible to reflect them in my masq rule ?

my only point was that since you don't actually do any *_filtering_* in
your filter rules, and allow all traffic to be MASQ'd to a public IP,
that there would be nothing stopping a client from doing whatever they
wanted to do--which was your original question.

if you actually *_filter_* traffic in the filter chains, there's nothing
wrong with having an outbound SNAT/MASQ rule that matches all traffic,
as only packets that pass through the filters will ever make it that
far.

i would suggest you go read:

  http://iptables-tutorial.frozentux.net/iptables-tutorial.html

seven times.

-j

--
"Salesman: Well, we found out what the problem with your vacuum
 cleaner was: Apparently there was a meatball lodged inside.
 Peter: Did you save the meatball?
 Salesman: Ummm, no...?
 Peter: You bastard."
        --Family Guy