[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Static NAT w/ iptables problem

> I'm not sure I get you here.  Do you want to appear as
> though it's running on,
> You're just connecting two private networks (one a DMZ), and you set
> aside an IP that will map to the DMZ address, correct?

Some additional info as to how this problem came to pass:
We are part of a larger company (got purchased not too long ago). They
want to access some of our servers. They provided a line and the subnet with the request to map the first server they
want to access to My own internal network is,
so snat seemed to be the obvious solution.
As a special quirk the gateway machine to their network has a completely
different address (public, I think) in it's own little (/29) network which
is where the address of eth1 really is going to be.

If the nat works i still need to configure some routing but I think I can
do that on my own.

OK, so I think what you have on the firewall machine is:
eth0 ip
eth1 ip a.b.c.d
eth1:0 ip
eth1:1 ip (I'll use this as a masquerading interface if we
                       need to contact some server on their side)

> (I will base my rules on that idea - if not, substitute)

(currently a machine I test with, ...195, but basically yes).

> for port in $server_ports; do
>   iptables -A FORWARD -p tcp --dport $port -j ACCEPT
>   iptables -t nat -A PREROUTING -d $DMZ_IP --dport $port -j DNAT --to $LAN_SERVER:$port
> done
> If you want requests to go to
> for port in $server_ports; do
>   iptables -A FORWARD -p tcp -i eth1 -d $LAN_SERVER --dport $port -j ACCEPT
> done

I did define server_ports="23" for telnet. I even added -m mport.
I'm sorry, I could get neither to fly. It said
  iptables: No chain/target/match by that name.

Currently I just want it to work with telnet, everything else is currently considered
icing on the cake.

Best regards,

| Dipl. Inform. Markus Trümper             |                                    |
|                                          | Daewoo Automobile Deutschland GmbH |
| email:   m.truemper@daewoo-automobile.de | Lindenstraße 110                   |
| www:     http://www.daewoo-automobile.de | 28755 Bremen                       |
| Telefon: +49 (0)421 668-4138             | Germany                            |
| Fax:     +49 (0)421 668-4192             |                                    |

Reply to: