From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jason Opperisano Subject: Re: Re - NAT to client Date: Sun, 1 May 2005 17:58:02 -0400 Message-ID: <20050501215802.GA8642@bender.817west.com> References: <8187f8816eb6.816eb68187f8@vsnl.net> Mime-Version: 1.0 Return-path: Content-Disposition: inline In-Reply-To: <8187f8816eb6.816eb68187f8@vsnl.net> List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: netfilter@lists.netfilter.org On Fri, Apr 29, 2005 at 07:13:37PM +0500, varun_saa@vsnl.net wrote: > >> # Generated by iptables-save v1.2.9 on Tue Apr 26 14:50:01 2005 > >> *nat > >> :OUTPUT ACCEPT [0:0] > >> :PREROUTING ACCEPT [0:0] > >> :POSTROUTING ACCEPT [0:0] > >> -A POSTROUTING -o eth0 -j MASQUERADE > > so you MASQ all outbound traffic > > Well should I or not. that's the only question you have from my post? > I have a static IP and my subnets are > > 192.168.0.0/24 > > 192.168.21.0/24 > > Is it possible to reflect them in my masq rule ? my only point was that since you don't actually do any *_filtering_* in your filter rules, and allow all traffic to be MASQ'd to a public IP, that there would be nothing stopping a client from doing whatever they wanted to do--which was your original question. if you actually *_filter_* traffic in the filter chains, there's nothing wrong with having an outbound SNAT/MASQ rule that matches all traffic, as only packets that pass through the filters will ever make it that far. i would suggest you go read: http://iptables-tutorial.frozentux.net/iptables-tutorial.html seven times. -j -- "Salesman: Well, we found out what the problem with your vacuum cleaner was: Apparently there was a meatball lodged inside. Peter: Did you save the meatball? Salesman: Ummm, no...? Peter: You bastard." --Family Guy