Владимир пишет:
Денис Ягофаров пишет:
хм...
# iptables -t nat -A PREROUTING -i 192.168.0.0/16 -p tcp --dport 21
-j SNAT --to 10.3.0.5:3128
iptables: Invalid argument
Все правильно, если SNAT, то цепочка POSTROUTING
Прописали....
#iptables -t nat -A POSTROUTING -o eth0 -p tcp --dport 80 -j SNAT --to
10.3.0.5:3128
Пробуем полазать по гуглу. В теории 10.3.0.5 должен про него спрашивать
_не_ мой хост:
# tcpdump -i veth1 src host 192.168.1.1 or src host 10.3.0.2 or dst host
192.168.1.1 or dst host 10.3.0.2
А вот на исходящем интерфейсе роутера:
# tcpdump -i eth1 src host 192.168.1.111 and dst port 80
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 96 bytes
13:32:43.255632 IP 192.168.1.111.4777 > fk-in-f99.google.com.http: S
3757065542:3757065542(0) win 65535 <mss 1460,nop,nop,sackOK>
13:32:43.306224 IP 192.168.1.111.4777 > fk-in-f99.google.com.http: . ack
1970806748 win 65535
13:32:43.306724 IP 192.168.1.111.4777 > fk-in-f99.google.com.http: P
0:750(750) ack 1 win 65535
13:32:43.390926 IP 192.168.1.111.4777 > fk-in-f99.google.com.http: . ack
3094 win 65535
Увы, пакеты в цепочку не попадают :(
# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
# iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
SNAT tcp -- anywhere anywhere tcp
dpt:http to:10.3.0.5:3128
SNAT tcp -- anywhere anywhere tcp dpt:ftp
to:10.3.0.5:3128
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
begin:vcard
fn:Denis Timurovich Yagofarov
n:Yagofarov;Denis Timurovich
org:ITGIS NASU
adr:room 615;;Chokolovski sqr., 13;Kiev;;03151;Ukraine
email;internet:[EMAIL PROTECTED]
title:system administrator
tel;work:80442480755
x-mozilla-html:FALSE
version:2.1
end:vcard
_______________________________________________
Sysadmins mailing list
[email protected]
https://lists.altlinux.org/mailman/listinfo/sysadmins
