Looking to exclude certain destinations from masquarade
I am trying to establish an ipsec tunnel from a system that is also a snat router. so far I seem to be able to have my masquerade or my vpn tunnel but not both.
the basic rules I'm using are these:
$IPTABLES -A FORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED,RELATED -j ACCEPT $IPTABLES -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT
$IPTABLES -A FORWARD -j LOG
$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE
Any suggestions?
Bruce Ferrell írta:
Quoted 9 lines
I am trying to establish an ipsec tunnel from a system that is also a snat router. so far I seem to be able to have my masquerade or my vpn tunnel but not both.
the basic rules I'm using are these:
$IPTABLES -A FORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED,RELATED -j ACCEPT $IPTABLES -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT
$IPTABLES -A FORWARD -j LOG
$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE
These are VERY BASIC rules...
Quoted 4 lines
Any suggestions?
You can use the MARK/CONNMARK target ot mark the vpn/nat packets.
With that information you will be able to do the NATing or leting through the vpn...
Swifty
Quoted 8 lines · Gáspár Lajos
Bruce Ferrell írta:
Quoted 7 lines
I am trying to establish an ipsec tunnel from a system that is also a snat router. so far I seem to be able to have my masquerade or my vpn tunnel but not both.
the basic rules I'm using are these:
$IPTABLES -A FORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED,RELATED -j ACCEPT $IPTABLES -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT
$IPTABLES -A FORWARD -j LOG
or you could use a rule like this:
$IPTABLES -t nat -A POSTROUTING -o $EXITIF -s $EXCLUDED_IP -j RETURN
Quoted 16 lines
Quoted 2 lines
$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE
These are VERY BASIC rules...
Quoted 4 lines
Any suggestions?
You can use the MARK/CONNMARK target ot mark the vpn/nat packets.
With that information you will be able to do the NATing or leting through the vpn...Swifty
Signature · 7 lines
<img src='http://www.danasoft.com/sig/spoonssig.jpg' /> -------------------------------------------------- RCHQ Hobbies cc http://www.rchq.co.za and http://store.rchq.co.za Fax: +27 86 652 2773 eMail: [email protected] P O Box 10376, Vorna Valley, Midrand, 1686 --------------------------------------------------