> No here is what I'm doing > > DNAT net loc:w.x.y.z:p1 tcp p2 > ACCEPT net dmz:r.s.t.u.v tcp p3 > > > If I do "telnet r.s.t.u.v p2" (or any other ip in the dmz) I'm > redirected to w.x.y.z:p1 > I would expect a reject connexion (as my default net2dmz rule is > reject) > If I "nmap r.s.t.u.v" I can see p2 opened... > > I hop I'm more clear :)
I assume that you only want the first DNAT rule to apply to connections
addressed to the firewall's external IP address? If so, and assuming
that the firewall's address is a.b.c.d, then change your first rule to:
DNAT net loc:w.x.y.z:p1 tcp p2 - a.b.c.d
-Tom
--
Tom Eastep \ When I die, I want to go like my Grandfather who
Shoreline, \ died peacefully in his sleep. Not screaming like
Washington, USA \ all of the passengers in his car
http://shorewall.net \________________________________________________
signature.asc
Description: This is a digitally signed message part
------------------------------------------------------------------------------ Get a FREE DOWNLOAD! and learn more about uberSVN rich system, user administration capabilities and model configuration. Take the hassle out of deploying and managing Subversion and the tools developers use with it. http://p.sf.net/sfu/wandisco-d2d-2
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
