Re - NAT to client

Re - NAT to client

[varun_saa]

On Thu, Apr 28, 2005 at 11:22:21AM +0500, varun_saa@vsnl.net wrote:

>> Hello,
>>      My server is om Mandrake 10.1
>> eth0 is WAN with static IP connected to 512K DSL.
>> eth1 is LAN - 192.168.0.0/24.
>> 
>> I have the iptables rules :
>> 
>> # Generated by iptables-save v1.2.9 on Tue Apr 26 14:50:01 2005
>> *nat
>> :OUTPUT ACCEPT [0:0]
>> :PREROUTING ACCEPT [0:0]
>> :POSTROUTING ACCEPT [0:0]
>> -A POSTROUTING -o eth0 -j MASQUERADE


so you MASQ all outbound traffic


-j


Well should I or not.
I have a static IP and my subnets are

192.168.0.0/24

192.168.21.0/24

Is it possible to reflect them in my masq rule ?


Varun

Re: Re - NAT to client

[Jason Opperisano]

On Fri, Apr 29, 2005 at 07:13:37PM +0500, varun_saa@vsnl.net wrote:
> >> # Generated by iptables-save v1.2.9 on Tue Apr 26 14:50:01 2005
> >> *nat
> >> :OUTPUT ACCEPT [0:0]
> >> :PREROUTING ACCEPT [0:0]
> >> :POSTROUTING ACCEPT [0:0]
> >> -A POSTROUTING -o eth0 -j MASQUERADE
> 
> so you MASQ all outbound traffic
> 
> Well should I or not.

that's the only question you have from my post?

> I have a static IP and my subnets are
> 
> 192.168.0.0/24
> 
> 192.168.21.0/24
> 
> Is it possible to reflect them in my masq rule ?

my only point was that since you don't actually do any *_filtering_* in
your filter rules, and allow all traffic to be MASQ'd to a public IP,
that there would be nothing stopping a client from doing whatever they
wanted to do--which was your original question.

if you actually *_filter_* traffic in the filter chains, there's nothing
wrong with having an outbound SNAT/MASQ rule that matches all traffic,
as only packets that pass through the filters will ever make it that
far.

i would suggest you go read:

  http://iptables-tutorial.frozentux.net/iptables-tutorial.html

seven times.

-j

--
"Salesman: Well, we found out what the problem with your vacuum
 cleaner was: Apparently there was a meatball lodged inside.
 Peter: Did you save the meatball?
 Salesman: Ummm, no...?
 Peter: You bastard."
        --Family Guy