netfilter question
Quoted 3 lines
Please post your complete ruleset, including the definitions >of variables such
here are the rule sets.
iptables -A FORWARD -i eth0 -o eth1 -m state --state \ESTABLISHED, RELATED -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
iptables -A FORWARD -j LOG
iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -o eth0 \
-d 161.x.x.x/21 -j SNAT --to 161.x.x.x
<iptables -L -nvx>
Chain INPUT (policy ACCEPT 127 packets, 9436 bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy ACCEPT 36 packets, 1709 bytes)
pkts bytes target prot opt in out source
destination
0 0 ACCEPT all -- eth0 eth1 0.0.0.0/0 0.0.0.0/0 state
RELATED, ESTABLISHED
0 0 ACCEPT all -- eth1 eth0 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
LOG flags 0 level 4
Chain OUTPUT (policy ACCEPT 74 packets, 8568 bytes)
pkts bytes target prot opt in out source destination
<iptables -t nat -L>
target prot opt source destination SNAT all -- 192.168.0.0/24 161.x.x.x/21 to:161.x.x.x
Quoted 8 lines · John Black
here are the rule sets.
iptables -A FORWARD -i eth0 -o eth1 -m state --state \ESTABLISHED, RELATED -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
iptables -A FORWARD -j LOGiptables -t nat -A POSTROUTING -s 192.168.0.0/24 -o eth0 \
-d 161.x.x.x/21 -j SNAT --to 161.x.x.x
Okay, so that rule is going to hide your 192.168.0.0/24 network behind the public address of the firewall for all packets going to addresses in the range 161.x.x.x/21 (ie 8 Class C's in size).
How are you testing this and deciding it doesn't work?
(By the way, why are you only translating packets which are going to
(presumably) your ISP? What about packets going anywhere else on the
Internet?).
Antony.
Signature · 6 lines
The words "e pluribus unum" on the Great Seal of the United States are from a
poem by Virgil entitled "Moretum", which is about cheese and garlic salad
dressing.
Please reply to the list;
please don't CC me.