From mboxrd@z Thu Jan 1 00:00:00 1970 From: Robby Workman Subject: Re: Enabling internal connections to transparently connect via external IP address Date: Thu, 31 May 2007 19:09:30 -0500 Message-ID: <465F63BA.3060101@rlworkman.net> References: Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="us-ascii" To: Chris Willis Cc: "'netfilter@lists.netfilter.org'" Chris Willis wrote: > Environment: > Windows XP laptop machine, part of domain acme.int, IP 192.168.1.150 > Windows 2003 Server running Exchange 2003 (exchange.acme.int, 192.168.1.10) > External Domain: acme.com (T1 line, firewall external IP & MX record mail.acme.com 60.60.60.60) > Firewall: PC running Fedora Core 6, IPTables, using FWBuilder to create a ruleset, 2 NICs (eth0 192.168.1.1, eth1 60.60.60.60) > > Problem: when a laptop user (works in office and remotely) goes to https://mail.acme.com, it works fine from the outside, but not from the inside. > > Goal: when an internal (192.168.1.X) client goes to https://mail.acme.com, the firewall should accept the packets, route them to the exchange box, and then route return packets back to the client. > > This works just fine on a netscreen firewall I tested with at the client site (same IP addresses as linux box above). There's the "dirty" way (IMHO): http://iptables-tutorial.frozentux.net/chunkyhtml/x4033.html There's the cleaner way (IMHO): Have your DNS server setup to serve internal clients the internal address of mail.acme.com. RW