On Aug 18, 2011, at 2:24 PM, Tom Eastep wrote:
>
> On Aug 18, 2011, at 11:57 AM, elhijo wrote:
>
>> Hi,
>> I manage a shorewall router with 3 NIC, one local, one wan and one dmz with
>> public ips.
>> I've noticed that if I connect to a host in the dmz to a local dnated port,
>> it redirect me to the dnated local host.
>
> I'm not understanding what problem your are trying to report. If your DMZ has
> public IP addresses, what is the purpose of your DNAT rules?
>
Are you doing something like this?
DNAT net dmz:w.x.y.z:p2 tcp p1 - w.x.y.z
If so, you will be able to connect from the net to port p2 on w.x.y.z unless
your iptables and kernel support "Extended Connection Tracking Match Support"
(see the output of 'shorewall show capabilities'). I have discovered that
iptables 1.4.12 is broken in that area. I've posted a correcting patch to the
Netfilter Development list.
If you do this:
DNAT net dmz:w.x.y.z:p2 tcp p1
then if you connect from the net to port p1 on ANY of your public IP addresses,
the connection will be forwarded to p2 on w.x.y.z. You correct that by also
placing y.x.y.z in the ORIGINAL DEST column as shown in the first rule above.
-Tom
Tom Eastep \ When I die, I want to go like my Grandfather who
Shoreline, \ died peacefully in his sleep. Not screaming like
Washington, USA \ all of the passengers in his car
http://shorewall.net \________________________________________________
------------------------------------------------------------------------------
Get a FREE DOWNLOAD! and learn more about uberSVN rich system,
user administration capabilities and model configuration. Take
the hassle out of deploying and managing Subversion and the
tools developers use with it. http://p.sf.net/sfu/wandisco-d2d-2
_______________________________________________
Shorewall-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-users
