On Friday 05 July 2002 08:44, deepali wrote: > Dear Support > My setup is ..I have one linux box having eth0(valid ip202.140.152.33) and > eth1(invalid ip-local lan192.168.220.250) .I have one more machine in my > Local Lan (192.168.220.90) which is a mail server in my local LAN.Now I > want to 1.enable port forwarding ie any request comming on 202.140.152.33 > port 285 should get forwarded to 192.168.220.90 port 25 my mail server. > > 2.Also any request comming from my lan ie 192.168.220.0/24 to invalid ip of > linux box ie 192.168.220.90 285 should also forwarded to my Mail server in > lan ie 192.168.220.30 port 25. > > My first synario is also not working. > > my rules are > > iptables -t nat -A PREROUTING -i eth0 -p tcp -d 202.140.136.90 --dport 285 > -j DNAT 182.168.220.90:25
You must have seen syntax error complaints about the DNAT option from iptables; in fact it should be: #iptables -t nat -A PREROUTING -i eth0 -p tcp -d 202.140.136.90 --dport 285 -j DNAT --to-destination 192.168.220.90:25 > iptables -t nat -A POSTROUTING -o eth0 -j MASQURADE Should read: MASQUERADE, but in that case is OK, and allows your local machines to get out to the internet. > iptables -t nat -A POSTROUTING -s 192.168.220.0/24 -j MASQURADE ?? Why? Isn't this already covered by the previous masquerading rule? And how about: #iptables -t nat -A PREROUTING -p tcp -d 192.168.220.90 --dport 285 -j DNAT --to-destination 192.168.220.90:25 This is the exact equivalent of your point 2), only expressed in iptables syntax. Jan Humme.
