hendrik@topoi.pooq.com wrote:
>
> But it doesn't work.
>
> Lines like
>
> iptables -t nat -A PREROUTING --protocol tcp -d 216.138.195.194 --dport 27012 -j DNAT --to-destination 172.25.1.5:27012 --verbose
> iptables -t nat -A PREROUTING --protocol udp -d 216.138.195.194 --dport 27012 -j DNAT --to-destination 172.25.1.5:27012 --verbose
> iptables -t nat -A POSTROUTING --protocol udp -s 172.25.1.5 --sport 27012 -j SNAT --to-source 216.138.195.194:27012 --verbose
> iptables -t nat -A POSTROUTING --protocol tcp -s 172.25.1.5 --sport 27012 -j SNAT --to-source 216.138.195.194:27012 --verbose
>
> have no effect at all (as checked by iptables --list)
You also need some "FORWARD" rules (don't know if you have them, on not).
E.g:
/sbin/iptables -A FORWARD -p tcp --dport 27012 -d 172.25.1.5 -j ACCEPT
/sbin/iptables -A FORWARD -p udp --dport 27012 -d 172.25.1.5 -j ACCEPT
> I suspect there's probably a missing kernel module. But which one?
> And where do I find it? The docs for iptables way that it will attampt
> to load any necessary modules, so I presume a simple modprobe isn't
> enough. Or else that it doesn't try hard enough.
This is a very useful example:
http://tldp.org/HOWTO/IP-Masquerade-HOWTO/stronger-firewall-examples.html#RC.FIREWALL-IPTABLES-STRONGER
Here is what I have in my script:
---
# Enable forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward
# Load some required (and a few optional) kernel modules
if [ -z "` $LSMOD | $GREP ip_tables | $AWK {'print $1'} `" ]; then
$MODPROBE ip_tables
fi
if [ -z "` $LSMOD | $GREP ip_conntrack | $AWK {'print $1'} `" ]; then
$MODPROBE ip_conntrack
fi
if [ -z "` $LSMOD | $GREP ip_conntrack_ftp | $AWK {'print $1'} `" ]; then
$MODPROBE ip_conntrack_ftp
fi
if [ -z "` $LSMOD | $GREP ip_conntrack_irc | $AWK {'print $1'} `" ]; then
$MODPROBE ip_conntrack_irc
fi
if [ -z "` $LSMOD | $GREP iptable_nat | $AWK {'print $1'} `" ]; then
$MODPROBE iptable_nat
fi
if [ -z "` $LSMOD | $GREP ip_nat_ftp | $AWK {'print $1'} `" ]; then
$MODPROBE ip_nat_ftp
fi
if [ -z "` $LSMOD | $GREP ip_nat_irc | $AWK {'print $1'} `" ]; then
$MODPROBE ip_nat_irc
fi
---
Hope this helps,
--
George Borisov
DXSolutions Ltd
Attachment:
signature.asc
Description: OpenPGP digital signature