Susefirewall2 redirecting

Susefirewall2 redirecting

[Chadley Wilson]

Greetings,

I am struggling to figure out what I have wrong, 

We have a remote desktop situation here. 

My firewall is a Suse 9.3 box, and works well, but now I have a problem with 
the firewall, and I think its because I lack some knowledge on how-to do 
this:

Our ISP hosts the dns records for ngn.annoip.org which resolves to 
196.31.62.99. But this is our firewall not the windows pc.

There are two lan cards in each the firewall 196.31.62 being the external and 
196.100.100 being the internal. 

Everthing on our lan must go through the firewall to gain access to the net 
and vica-versa,

I have treid a few rules to redirect traffic from the internet --dport 3389 to 
the remote desktop pc port 3389. But nothing seems to work.
These are the currecnt rules in my firewall setup for this.

-A PREROUTING -s 196.31.62.0/255.255.255.0 -d 196.100.100.2 -p tcp -m tcp 
--dport 3389 -j MARK --set-mark 0x1

-A PREROUTING -s 196.31.62.0/255.255.255.0 -d 196.100.100.2 -p udp -m udp 
--dport 3389 -j MARK --set-mark 0x1

-A forward_ext -s 196.31.62.0/255.255.255.0 -d 196.100.100.2 -p tcp -m limit 
--limit 3/min -m tcp --dport 3389 -m state --state NEW -j LOG --log-prefix 
"SFW2-FWDext-ACC-REVMASQ " --log-tcp-options --log-ip-options

-A forward_ext -s 196.31.62.0/255.255.255.0 -d 196.100.100.2 -p tcp -m tcp 
--dport 3389 -j ACCEPT

-A forward_int -s 196.31.62.0/255.255.255.0 -d 196.100.100.2 -p tcp -m limit 
--limit 3/min -m tcp --dport 3389 -m state --state NEW -j LOG --log-prefix 
"SFW2-FWDint-ACC-REVMASQ " --log-tcp-options --log-ip-options

-A forward_int -s 196.31.62.0/255.255.255.0 -d 196.100.100.2 -p tcp -m tcp 
--dport 3389 -j ACCEPT

-A input_ext -p tcp -m limit --limit 3/min -m tcp --dport 3389 --tcp-flags 
SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-ACC-TCP " --log-tcp-options 
--log-ip-options

-A input_ext -p tcp -m tcp --dport 3389 -j ACCEPT

-A input_ext -p udp -m udp --dport 3389 -j ACCEPT

-A PREROUTING -s 196.31.62.0/255.255.255.0 -d 196.100.100.2 -p tcp -m tcp 
--dport 3389 -j REDIRECT --to-ports 3389

-A PREROUTING -s 196.31.62.0/255.255.255.0 -d 196.100.100.2 -p udp -m udp 
--dport 3389 -j REDIRECT --to-ports 3389

-A PREROUTING -s 196.31.62.0/255.255.255.0 -d 196.31.62.99 -i eth0 -p tcp -m 
tcp --dport 3389 -j DNAT --to-destination 196.100.100.2:3389


Any ideas as to how I can force this to work?

TIA

-- 
--
Chadley Wilson
Production Line Superintendant
Pinnacle Micro
Manufacturers of Proline Computers
====================================
Exercise freedom, Use LINUX
=====================================

Re: Susefirewall2 redirecting

[Matt Zagrabelny]

> Any ideas as to how I can force this to work?

silly question: have you provisioned your box to forward?

# cat 1 > /proc/sys/net/ipv4/ip_forward

edit /etc/sysctl.conf for a permanent solution.

-matt zagrabelny