Re: DNAT PREROUTING issue with IPTABLES
|[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]|
Indunil Jayasooriya wrote:
> SECOND Firewall's default route (gateway) is NOT the FIRST firewall.
> BOTH firewall's default route (gateway) is the router given by our ISP.
Ok, so you understand your problem now?
Assuming the packet arrives at 220.127.116.11 from random external ip (eg.
18.104.22.168), is successfully dnat+rerouted to 22.214.171.124, there again
dnat+reroute to 192.168.x.x. Arrives at smtp server and smtp server
sends a reply to the original sender 126.96.36.199. It does that via it's
default gateway which I assume is 188.8.131.52. 184.108.40.206 sends it via your
ISP's gateway with it's own address of 220.127.116.11 to 18.104.22.168.
But 22.214.171.124 sent the packet 126.96.36.199, not 188.8.131.52, so it discards it.
And that's exactly what Riccardo said when I read his mail now.
The first problem though is that I'm not sure the dnat form 184.108.40.206 to
220.127.116.11 works, the packet would have to leave via the same interface it
came. Maybe this works, I've never tried that. Make sure packets arrive
on the smtp box with tcpdump.
As for the solution, one way would be to SNAT the connection at FW1, but
this wwould cause the smtp box to see as if all the incoming connections
are from 18.104.22.168 and not their real IP's (22.214.171.124).
Actually you should set up custom routing at 126.96.36.199 and not DNAT. You'd
have to mark the packets and then send them to the 188.8.131.52 fw via a
custom route. I'm not sure I could help you with that, never done any
+372 6659 649
LARTC mailing list
_______________________________________________ LARTC mailing list LARTC@xxxxxxxxxxxxxxx http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc