NATing on a single interface?
rnicholsNOSPAM at comcast.net
Fri Oct 27 01:52:44 CEST 2006
Philip Pemberton wrote:
> It appears to be mangling the packets - e.g. an inbound packet from
> 22.214.171.124 to 126.96.36.199 (PPP_IP) gets its destination IP changed to
> the DMZ address (e.g. 10.0.0.1 for my server). Return packets are sent
> to the source (e.g. 188.8.131.52 in the example) using the DSL router
> (10.1.0.2) as the gateway.
> What I need to figure out is how to actually set up the firewall. I >
> did find a nice IPTables tutorial, but it's 357 pages long! Guess I'd
> better stop procrastinating and start reading....
If your other machines are set up to use the DSL router as the default
route, of course that's where the return packets will go. You have
1. (Preferable) Set up the default route on your other machines so
that they use the firewall machine as their gateway to the outside
2. SNAT the forwarded packets so that they appear to come from the
firewall machine. This really screws up logging on your other
machines (all traffic will appear to originate on the firewall
machine), so you probably don't want to do it that way.
If that's Oskar Andreasson's tutorial you've got, you'll find you
really don't need to read through the whole thing. The section on
the DNAT target is what you need right now.
Bob Nichols Yes, "NOSPAM" is really part of my email address.
More information about the netfilter