* Is this suitable (2)?
@ 2004-11-22 11:23 Alexis
0 siblings, 0 replies; only message in thread
From: Alexis @ 2004-11-22 11:23 UTC (permalink / raw)
To: netfilter
Im doing some tests in the lab, i have this idea and i want
to know if this is suitable to do.
This is the idea (not mine, customer,and the customer is
always right) , suppose this schema
Wap server <-> GW
SQL server _|
My customer wants to wap server send the sql queries to GW
(so the wap box thinks that sql server is the gw box), then
gw redirect the sql request to the sql server, and replies
then follow the same way back.
For this case WAP server is in a dmz, sql is in another dmz,
and sql server is in the local lan (different from the
dmz's). The idea to fit 2 nic's to the GW is discarded
because the only device allowed to interconnect the DMZ's,
the LAN and the WAN are the firewalls.
So I need to do this.
In GW using only 1 NIC, rederirect the traffic in both directions.
Using mysql as an example and this addresses
Wap server: 10.11.0.20
GW: 10.12.0.10 (gw 10.12.0.1)
SQL: 10.10.2.205
Will this rules in the gw box work?
(filter:INPUT and filter:FORWARD policies are DROP)
ip ro add default via 10.12.0.1
iptables -t nat -A PREROUTING -s 10.11.0.20 -d 10.12.0.10 -p tcp --dport
3306 -j DNAT --to 10.10.2.205:3306
iptables -t nat -A PREROUTING -s 10.10.2.205 -d 10.12.0.10 -p tcp --sport
3306 -j DNAT --to 10.11.0.20
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -m state --state NEW -s 10.11.0.20 -d 10.12.0.10 -p tcp
--dport 3306 -j ACCEPT
iptables -A FORWARD -m state --state NEW -s 10.10.2.205 -d 10.12.0.10 -p tcp
--sport 3306 -j ACCEPT
Is this enough????
I think that, as the connections will be always started from
wap server, the second FORWARD rule will not match never,
because this match will be in the RELATED,ESTABLISHED rule,
but the main doubt is if this is correct in the nat table.
Thanks in advance.
Best regards
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2004-11-22 11:23 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2004-11-22 11:23 Is this suitable (2)? Alexis
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox