Mailing List Archive


I am with DNAT problem.

Somebody can help me? I use iptables since 2002.
But now with fedora 5 and iptables v1.3.5 only the PREROUTING rules (DNAT)
do not function, these rules had been copied of a Fedora 4 with iptables
v1.3.0 where everything functioned.

Re: PREROUTING problem [ In reply to ]

Diego K. a écrit :
> Hello, I have the following problem
> LAN ---------------------------------Etch Linux
> Firewall-----------------------------------------------------Internet
> 10.1.x.x/16 | eth1: eth0:
> |
> |
> |
> Server1:

[Beware of line wrapping]

> When I get a conection from the internet to, the ip
> forward works OK to server1, but when I try to connect to
> from the LAN its does not work, I know that i can connect to
> but I need from both IPs, private and public from the LAN

Well known routing problem. Replies from the server go directly back to
the client and arrive there with the wrong source address.

> I have the following config
> iptables -t nat -A PREROUTING -s 0/0 -p tcp -d --dport 80
> -j DNAT --to
> iptables -A FORWARD -p tcp -d --dport 80 -j ACCEPT

You must SNAT the connections coming from the LAN so the reply packets
go back to the firewall which puts back the correct source address.
Adding the following rule should do it :

iptables -t nat -A POSTROUTING -o eth1 -s -d \
-p tcp --dport 80 -j SNAT --to

Note that this will prevent the server from seeing the real source
address when a connection comes from the LAN using the public address.

Also make sure traffic in FORWARD from eth1 to eth1 is accepted.