Looking to exclude certain destinations from masquarade

Looking to exclude certain destinations from masquarade

[Bruce Ferrell]

I am trying to establish an ipsec tunnel from a system that is also a 
snat router.  so far I seem to be able to have my masquerade or my vpn 
tunnel but not both.

the basic rules I'm using are these:

$IPTABLES -A FORWARD -i $EXTIF -o $INTIF -m state --state 
ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT
$IPTABLES -A FORWARD -j LOG
$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE


Any suggestions?

Re: Looking to exclude certain destinations from masquarade

[Gáspár Lajos]

Bruce Ferrell írta:
> I am trying to establish an ipsec tunnel from a system that is also a 
> snat router.  so far I seem to be able to have my masquerade or my vpn 
> tunnel but not both.
>
> the basic rules I'm using are these:
>
> $IPTABLES -A FORWARD -i $EXTIF -o $INTIF -m state --state 
> ESTABLISHED,RELATED -j ACCEPT
> $IPTABLES -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT
> $IPTABLES -A FORWARD -j LOG
> $IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE
>
These are VERY BASIC rules...
>
> Any suggestions?
>
>
You can use the MARK/CONNMARK target ot mark the vpn/nat packets.
With that information you will be able to do the NATing or leting 
through the vpn...

Swifty

Re: Looking to exclude certain destinations from masquarade

[Ray Leach]

[-- Attachment #1: Type: text/plain, Size: 1220 bytes --]



Gáspár Lajos wrote:
> Bruce Ferrell írta:
>> I am trying to establish an ipsec tunnel from a system that is also a 
>> snat router.  so far I seem to be able to have my masquerade or my 
>> vpn tunnel but not both.
>>
>> the basic rules I'm using are these:
>>
>> $IPTABLES -A FORWARD -i $EXTIF -o $INTIF -m state --state 
>> ESTABLISHED,RELATED -j ACCEPT
>> $IPTABLES -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT
>> $IPTABLES -A FORWARD -j LOG
or you could use a rule like this:
$IPTABLES -t nat -A POSTROUTING -o $EXITIF -s $EXCLUDED_IP -j RETURN


>> $IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE
>>
> These are VERY BASIC rules...
>>
>> Any suggestions?
>>
>>
> You can use the MARK/CONNMARK target ot mark the vpn/nat packets.
> With that information you will be able to do the NATing or leting 
> through the vpn...
>
> Swifty
>
>
>
>
>

-- 
<img src='http://www.danasoft.com/sig/spoonssig.jpg' />
--------------------------------------------------
RCHQ Hobbies cc
http://www.rchq.co.za and http://store.rchq.co.za
Fax: +27 86 652 2773       eMail: admin@rchq.co.za
P O Box 10376, Vorna Valley, Midrand, 1686
--------------------------------------------------