[ale] iptables problems...static NAT and filtering rules...

[james at sumners.ath.cx]

I am not the world's best with iptables but I can kludge my way through
it. I am attaching a script I wrote for a router/firewall to manage my
dsl connection. Hopefully it will answer your question. I am sure there
are some redundant rules in it but I am not sure which ones.

On Thu, Aug 05, 2004 at 02:47:02PM -0400, Christopher Woodfield wrote:
> Hello,
> 
> I tried to set up static NAT rules on my iptables firewall, and was not 
> able to get it to work. A possible cause of the problem (which I 
> haven't been able to test yet) is that I have a series of port-specific 
> rules for each host in addition to the SNAT and DNAT rules.
> 
> Here are my SNAT/DNAT rules. $HOSTNAME variables are public IPs and 
> $HOSTNAME_NAT are private IPs; $INETIF is the outside interface and 
> $LANIF is the inside:
> 
> # Set up Static SNAT entries (private to public)
> $IPTABLES -t nat -A POSTROUTING -o $INETIF -s $TINO_NAT -j SNAT 
> --to-source $TINO
> $IPTABLES -t nat -A POSTROUTING -o $INETIF -s $ELECTRO_NAT -j SNAT 
> --to-source $ELECTRO
> $IPTABLES -t nat -A POSTROUTING -o $INETIF -s $TWEEK_NAT -j SNAT 
> --to-source $TWEEK
> 
> # Set up Static DNAT entries (public to private)
> $IPTABLES -t nat -A PREROUTING -i $INETIF -d $TINO -j DNAT 
> --to-destination $TINO_NAT
> $IPTABLES -t nat -A PREROUTING -i $INETIF -d $ELECTRO -j DNAT 
> --to-destination $ELECTRO_NAT
> $IPTABLES -t nat -A PREROUTING -i $INETIF -d $TWEEK -j DNAT 
> --to-destination $TWEEK_NAT
> #
> 
> Then I have a series of port rules, an example is below:
> 
> # ssh
> $IPTABLES -A FORWARD -p tcp -i $INETIF -o $LANIF -d $TINO_NAT --dport 
> 22 -j ACCEPT
> 
> Are rules like these evaluated before or after the DNAT transformation 
> is done? That is, should the -d on these rules be $TINO_NAT or $TINO?
> 
> Thanks,
> 
> -C

-- 
James Sumners
http://ug.dyndns.org/~jsumners/

"All governments suffer a recurring problem: Power attracts pathological personalities. It is not that power corrupts but that it is magnetic to the corruptible. Such people have a tendency to become drunk on violence, a condition to which they are quickly addicted."

Missionaria Protectiva, Text QIV (decto)
CH:D 59
-------------- next part --------------
A non-text attachment was scrubbed...
Name: iptables.sh
Type: application/x-sh
Size: 1731 bytes
Desc: not available