dnat question

Since i'm running separate servers for FTP, Mail, and Web, and using dnat to port forward to these machines. Do i need these ports open on the firewall?

john

http://www.arbbs.net/

<snip>
I am not an expert on the inward workings of iptables but I would assume that you do. The NAT targets will change the source and destination addresses but the packets (at least the first packet in the case of connection tracking) must traverse the FORWARD chain of the filter table. It will pass through that table with the real address so there must be a rule to allow access to the real address.

If someone tells you otherwise, listen to them :-)

Open Source Development Corporation
Financially Sustainable open source development
http://www.opensourcedevelopmentcorp.com

No. You are not running the services on the firewall, therefore you don't
need the ports open on the firewall. The firewall is simply passing the
packets on to somewhere else.

Antony.

Documentation is like sex.
When it's good, it's very very good.
When it's bad, it's still better than nothing.

                                                     Please reply to the list;
                                                           please don't CC me.

What you say is correct - you must have a rule in the FORWARD chain to allow the packets through the firewall.

However, I think this is a very different thing from "having the ports open on the firewall", since to me this means that the firewall itself is listening on those ports.

Hopefully the combination of your explanation about the FORWARD chain and my previous explanation about not running local services has clarified things :)

Regards,

Antony.

Never write it in Perl if you can do it in Awk.
Never do it in Awk if sed can handle it.
Never use sed when tr can do the job.
Never invoke tr when cat is sufficient.
Avoid using cat whenever possible.

                                                     Please reply to the list;
                                                           please don't CC me.