On Sat, Sep 27, 2003 at 11:17:52AM -0500, Andrew Gaffney wrote:
This line here is your problem. You need to either change it to:
${IPTABLES} -P FORWARD ACCEPT -or- ${IPTABLES} -A FORWARD -s 10.0.0.0/24 -j ACCEPT
rules are now
# allow local-only connections ${IPTABLES} -A INPUT -i lo -j ACCEPT
# free output on any interface to any ip for any service ${IPTABLES} -A OUTPUT -j ACCEPT
# permit answers on already established connections # and permit new connections related to established ones ${IPTABLES} -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT ${IPTABLES} -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
# allow incomg ssh connections ${IPTABLES} -A INPUT -p tcp --dport ssh -j ACCEPT
# NAT ${IPTABLES} -t nat -A POSTROUTING -o eth0 -j MASQUERADE ${IPTABLES} -A FORWARD -s 10.0.0.0/24 -j ACCEPT
# log everything else ${IPTABLES} -A INPUT -j LOG --log-prefix "FIREWALL:INPUT "
# everything not accepted > /dev/null ${IPTABLES} -P INPUT DROP ${IPTABLES} -P FORWARD DROP ${IPTABLES} -P OUTPUT DROP
still nothing
How are you testing that it is working? Try 'ping 195.66.242.4' to test it out. If this works, then you either need to setup a DNS server on the NAT box, or have DHCP give the inside box the IP to a real DNS server.
-- Andrew Gaffney
-- [EMAIL PROTECTED] mailing list
