[EMAIL PROTECTED] wrote: > > But it doesn't work. > > Lines like > > iptables -t nat -A PREROUTING --protocol tcp -d 216.138.195.194 --dport 27012 > -j DNAT --to-destination 172.25.1.5:27012 --verbose > iptables -t nat -A PREROUTING --protocol udp -d 216.138.195.194 --dport 27012 > -j DNAT --to-destination 172.25.1.5:27012 --verbose > iptables -t nat -A POSTROUTING --protocol udp -s 172.25.1.5 --sport 27012 -j > SNAT --to-source 216.138.195.194:27012 --verbose > iptables -t nat -A POSTROUTING --protocol tcp -s 172.25.1.5 --sport 27012 -j > SNAT --to-source 216.138.195.194:27012 --verbose > > have no effect at all (as checked by iptables --list)
You also need some "FORWARD" rules (don't know if you have them, on not). E.g: /sbin/iptables -A FORWARD -p tcp --dport 27012 -d 172.25.1.5 -j ACCEPT /sbin/iptables -A FORWARD -p udp --dport 27012 -d 172.25.1.5 -j ACCEPT > I suspect there's probably a missing kernel module. But which one? > And where do I find it? The docs for iptables way that it will attampt > to load any necessary modules, so I presume a simple modprobe isn't > enough. Or else that it doesn't try hard enough. This is a very useful example: http://tldp.org/HOWTO/IP-Masquerade-HOWTO/stronger-firewall-examples.html#RC.FIREWALL-IPTABLES-STRONGER Here is what I have in my script: --- # Enable forwarding echo 1 > /proc/sys/net/ipv4/ip_forward # Load some required (and a few optional) kernel modules if [ -z "` $LSMOD | $GREP ip_tables | $AWK {'print $1'} `" ]; then $MODPROBE ip_tables fi if [ -z "` $LSMOD | $GREP ip_conntrack | $AWK {'print $1'} `" ]; then $MODPROBE ip_conntrack fi if [ -z "` $LSMOD | $GREP ip_conntrack_ftp | $AWK {'print $1'} `" ]; then $MODPROBE ip_conntrack_ftp fi if [ -z "` $LSMOD | $GREP ip_conntrack_irc | $AWK {'print $1'} `" ]; then $MODPROBE ip_conntrack_irc fi if [ -z "` $LSMOD | $GREP iptable_nat | $AWK {'print $1'} `" ]; then $MODPROBE iptable_nat fi if [ -z "` $LSMOD | $GREP ip_nat_ftp | $AWK {'print $1'} `" ]; then $MODPROBE ip_nat_ftp fi if [ -z "` $LSMOD | $GREP ip_nat_irc | $AWK {'print $1'} `" ]; then $MODPROBE ip_nat_irc fi --- Hope this helps, -- George Borisov DXSolutions Ltd
signature.asc
Description: OpenPGP digital signature
