Re: Forwarding packets over the same LAN

[Mart Frauenlob <mart.frauenlob@chello.at>]

Simion Onea wrote:
> On Mon, 2009-07-13 at 16:14 +0200, Thomas Jacob wrote:
>   
>> You need DNAT+SNAT for this:
>>
>> # Redirect to IP:Port
>> iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 10025 \
>> 	 -j DNAT --to-destination 172.20.1.254:25
>>
>> # Ensure that the replies come back to us
>> iptables -t nat -A POSTROUTING -o eth0 -p tcp --dport 25 \
>>          -d 172.20.1.254  -j SNAT --to-source 172.20.1.245
>>     
>
> Hi Thomas!
>
> I tried these rules but it seems that packets to not pass the first
> rule. To test this I put two LOG targets before and after the PREROUTING
> rule like this:
>
> iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 10025 -j LOG
> --log-tcp-options --log-prefix PREROUTING_before:
> iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 10025 -j DNAT
> --to-destination 172.20.1.254:25
> iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25 -j LOG
> --log-tcp-options --log-prefix PREROUTING_after:
> iptables -t nat -A POSTROUTING -o eth0 -p tcp -d 172.20.1.254 --dport 25
> -j SNAT --to-source 172.20.1.245
>
> As a result I received in the log three messages with
> "PREROUTING_before" -- these were SYN packets. And no message with
> "PREROUTING_after" :-(
>
> What could be wrong ?
>
> Regards,
> Simion.
>   
Remember for the POSTROUTING rule, the previously redirected packets 
come from the host:port, NOT go to the host again.
You need `-s xxx.xxx.xxx.xxx --sport xx' -j SNAT ....

Greets

Mart