<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.2900.2802" name=GENERATOR></HEAD>
<BODY style="MARGIN-TOP: 2px; FONT: 10pt Arial; MARGIN-LEFT: 2px">
<DIV>Russell,</DIV>
<DIV>Thanks for the info</DIV>
<DIV>The external is a static ipaddress. Are you saying the external of
the gateway server or the internet public ip address. I ask because
the external iface of the gateway server is in 192.168.100.xxx which connects to
the cisco router ethernet iface. The external ip address of the router is
static also.</DIV>
<DIV>Just curious why POSTROUTING vs PREROUTING, from what I understand we are
changing the source ip address after the routing has taken place and this will
go out the external iface with a different (external iface) ip address. So
if the internal ip address was 192.168.1.143 it would go out the gateway server
as 192.168.100.2 and this would hit the c2821 router and change agin from
192.168.100.2 to 203.161.xx.xx. Is this correct, just want to make
sure this is fully understood.</DIV>
<DIV> </DIV>
<DIV>Funny how different iptables works vs novell bordermanager.</DIV>
<DIV> </DIV>
<DIV>Thanks</DIV>
<DIV><BR><BR>>>> r.steicke@bom.gov.au 3:13:44 pm 1/02/2006
>>><BR>On Thu, Feb 02, 2006 at 07:10:28AM +0800, Jon Miller
wrote:<BR>> I'm having a major problem trying to forward packets from either
a workstation of the LAn to the Internet.<BR>> I want to be sure I'm doing
this correctly.<BR>> <BR>> I set a forward rule:<BR>> $IPT -A FORWARD
-i $INT_IFACE -o eth1 -p tcp --dport 1262 -j ACCEPT<BR>> <BR>> Then I set
a PREROUTING rule <BR>> $IPT -A PREROUTING -i $EXT_IFACE -p tcp --dport 1262
-j DNAT --to-destination 192.168.xxx.xxx<BR><BR>You need source NAT, not
destination NAT, and you need to specify this<BR>in the nat table (not the
filter table which is the default table<BR>without a -t option). Only one
rule required:<BR><BR> iptables -t nat -A POSTROUTING -s 192.168.0.0/16 -o
eth0 -j SNAT --to 1.2.3.4<BR><BR>where 1.2.3.4 is your external address and eth0
is your external<BR>interface. If you have a dynamic address, use the
MASQUERADE target<BR>(instead of SNAT) without the --to option.<BR><BR>This is
explained in the docs at netfilter.org.<BR><BR> <A
href="http://netfilter.org/documentation/HOWTO//NAT-HOWTO-6.html#ss6.1">http://netfilter.org/documentation/HOWTO//NAT-HOWTO-6.html#ss6.1</A><BR><BR>>
All I can see using tethereal on the network is SYN packets.<BR><BR>If the
packets are being forwarded (see below) they will have a<BR>private source
address, with the rules you're using, and are probably<BR>being dropped by your
ISP, so you'll see no replies.<BR><BR>> Any idea what I'm doing
wrong?<BR><BR>A common oops is to forget to enable forwarding in the
kernel.<BR><BR> # cat /proc/sys/net/ipv4/ip_forward<BR>
1<BR><BR>Make sure that returns a 1, not a 0. If it doesn't,
do<BR><BR> # echo 1 > /proc/sys/net/ipv4/ip_forward<BR><BR>and then
edit /etc/sysctl.conf to make it survive a reboot.<BR><BR><BR><BR><BR>--
<BR>Russell Steicke<BR><BR>-- Fortune says:<BR>Pecor's Health-Food
Principle:<BR> Never eat rutabaga on any day of the week that
has a "y" in it.<BR>_______________________________________________<BR>PLUG
discussion list: plug@plug.org.au<BR><A
href="http://www.plug.org.au/mailman/listinfo/plug">http://www.plug.org.au/mailman/listinfo/plug</A><BR>Committee
e-mail: committee@plug.linux.org.au<BR></DIV></BODY></HTML>