Re: iptables abilities

[Sven Burgener <sburgener@objeng.ch>]

Antony Stone wrote:
> The only reason you can't route private addresses across the Internet is that 
> all ISP routers drop packets sent to these address ranges.

Right.

> You would set up your VPN system to forward these packets, just the same as 
> you can set up your own firewalls and routers to forward them if you want to.
> 
> A VPN with two RFC1918 ranges at each end is a very common setup.

Yes, indeed.

My question, though, is how can a connection be established between two 
parties where one of them has a private address (A) and where you want 
to connect _to_ the server having the private address (A, see below).

The problem is, you can't establish a connection to the private address 
(A), so there has to be a means of 'hijacking' the established session 
(from X, see diagram below).


         (Internet)       (Internet)
     A <------------> X <------------> B

A: 192.168.X.X
B: 192.168.X.X
X: public IP address

The end result is to get from B to A, securely.

Cheers
Sven