tcp packets on 25 port FORWARDING
Try this:
LAN_IP=$(ifconfig eth1 | head -n 2 | tail -n 1 | cut -d: -f2 | cut -d" " -f 1) ipatbles -t nat -A PREROUTING -i *EXT-NIC* -p tcp --dport 25 -j DNAT --to_destination *POSTFIX-IP* iptables -t nat -A POSTROUTING -o *INT-NIC* -p tcp --dport 25 -j SNAT --to-source $LAN_IP iptables -A FORWARD -i *EXT-NIC* -m state --state NEW -p tcp -d *POSTFIX-IP* --dport 25 -j ACCEPT
EXT-NIC = your external Network Interface (eth0, eth1...)
INT-NIC = your internal Network Interface (eth1, eth2...) where your Postfix Server is connected to POSTFIX-IP = The IP of your Postfix Server
That should work.
Mit freundlichen Gru� / Best regards / Meilleures
salutation / Met vriendelijke groet
Peter Gehle
Systemberatung Gehle GmbH
Im Bahler Grund 5
D-49413 Dinklage
Germany
Phone : +49 4443 9796-12
Fax : +49 4443 9796-29
www.sbgit.com
Original Message processed by Tobit InfoCenter
Subject: tcp packets on 25 port FORWARDING (12-Mrz-2004 10:50) From: [email protected] To: [email protected]
Hi there,
I need to forward all tcp packets with port 25 (SMTP) from Internet to machine in my network. My settings (eth0 = internet IP, eth1 = 192.168.200.1 - dmz IP connected to another machine with Postfix, eth2 = 192.168.0.1 - gateway - LAN). Have opened port 25 and setup rule :
iptables -t nat -A PREROUTING -p tcp -dport 25 - i eth0 -j DNAT -to 192.168.200.2:85
iptables -A FORWARD -i eth0 -p tcp -d 192:168.200.2 -dport 25 -m state -state NEW,ESTABLISHED,RELATED -j ACCEPT
But it still doesn't route tcp packets on port 25 to my Postfix computer :o( If I try telnet 192.168.200.2 25 from FW it works, if I try this from Internet, it doesn't work :o( Any ideas ? Thanks a lot. Stan.
Quoted 3 lines · On Friday 12 March 2004 10:03 am, [email protected] wrote:
Try this:
LAN_IP=$(ifconfig eth1|head -n 2|tail -n 1|cut -d: -f2|cut -d" " -f1)
A simpler version is ifconfig eth1|grep inet|tr -s ': ' '\t'|cut -f4
Quoted 5 lines
iptables -t nat -A PREROUTING -i *EXT-NIC* -p tcp --dport 25 -j DNAT --to_destination *POSTFIX-IP*
iptables -t nat -A POSTROUTING -o *INT-NIC* -p tcp --dport 25 -j SNAT --to-source $LAN_IP
Why include this rule? It will make all email received by the Postfix
machine appear to come from the Firewall, not the real IP address of the
sending server. This will make anti-spam measures more difficult / less
effective.
Quoted 2 lines
iptables -A FORWARD -i *EXT-NIC* -m state --state NEW -p tcp -d *POSTFIX-IP* --dport 25 -j ACCEPT
What about NEW packets from inside to outside (eg delivering mail to the Internet?)
Also don't forget that a mail server is likely to want to do things like DNS lookups.
Regards,
Antony.
Signature · 6 lines
Having been asked for a reference for this man,
I can confirm that you will be very lucky indeed if you can get him to work
for you.
Please reply to the list;
please don't CC me.