[SLUG] iptables DNAT help required

2002-03-23 Thread Peter Rundle 

Sluggers,

I'm playing around with DNAT on iptables but whenever I try to put the 
rule in I just
get an error "Invalid argument". I've looked at a number of examples on 
the net and
they all seem to be doing the same thing that I am. Does anyone know if 
there is
a version problem? I've got kernel 2.4.7-10 and iptables 1.2.3-1

Basically I want to have my firewall allow http traffic through from the 
outside world
to a linux box on the internal net but this is what happens..

# iptables -t nat -A POSTROUTING -p tcp -s 0/0 --dport 80 -j DNAT --to 
192.168.1.99
iptables: Invalid argument

Cluesticks?

Thanks

Pete



-- 
SLUG - Sydney Linux User Group Mailing List - http://slug.org.au/
More Info: http://lists.slug.org.au/listinfo/slug

Re: [SLUG] iptables DNAT help required

2002-03-23 Thread Crossfire 

Peter Rundle was once rumoured to have said:
> Sluggers,
> 
> I'm playing around with DNAT on iptables but whenever I try to put
> the rule in I just get an error "Invalid argument". I've looked at a
> number of examples on the net and they all seem to be doing the same
> thing that I am. Does anyone know if there is a version problem? 
> I've got kernel 2.4.7-10 and iptables 1.2.3-1
> 
> Basically I want to have my firewall allow http traffic through from
> the outside world to a linux box on the internal net but this is
> what happens..
> 
> # iptables -t nat -A POSTROUTING -p tcp -s 0/0 --dport 80 -j DNAT --to 
> 192.168.1.99
> iptables: Invalid argument
> 
> Cluesticks?

s/POSTROUTING/PREROUTING/

DNAT has to be applied before a routing decision is made so the
packets can be routed correctly.

C.
-- 
--==--
  Crossfire  | This email was brought to you
  [EMAIL PROTECTED] | on 100% Recycled Electrons
--==--
-- 
SLUG - Sydney Linux User Group Mailing List - http://slug.org.au/
More Info: http://lists.slug.org.au/listinfo/slug

Re: [SLUG] iptables DNAT help required

2002-03-24 Thread Daniel Stone 

On Sun, Mar 24, 2002 at 07:12:52PM +1100, Crossfire wrote:
> Peter Rundle was once rumoured to have said:
> > # iptables -t nat -A POSTROUTING -p tcp -s 0/0 --dport 80 -j DNAT --to 
> > 192.168.1.99
> > iptables: Invalid argument
> > 
> > Cluesticks?
> 
> s/POSTROUTING/PREROUTING/
> 
> DNAT has to be applied before a routing decision is made so the
> packets can be routed correctly.

Conversely, SNAT has to be applied in POSTROUTING.

-- 
Daniel Stone<[EMAIL PROTECTED]>
 OMFG ... yesterday's head hunter wants contact information for Linus
now that I told him he's probably the only person with 10 years of
continuous Linux experience ;)



msg21895/pgp0.pgp
Description: PGP signature

Re: [SLUG] iptables DNAT help required

2002-03-24 Thread Peter Rundle 

>
>
>s/POSTROUTING/PREROUTING/
>
>DNAT has to be applied before a routing decision is made so the
>packets can be routed correctly.
>

Hmmm, ok that makes sense. 'spose I should send a mail to the author and 
let him
know that his webpage is wrong (uh hmm "incorrect" :-)

Anyways the rule sticks now but I don't have successful connection yet. 
Is there
a way to log / watch the packets?

Do I need another matching rule to allow the return packets to be 
reverse nat'd
so that they go back out to the internet?

Thanks

Pete



-- 
SLUG - Sydney Linux User Group Mailing List - http://slug.org.au/
More Info: http://lists.slug.org.au/listinfo/slug

Re: [SLUG] iptables DNAT help required

2002-03-24 Thread Peter Rundle 


Oops,

Ignore that last question, I forgot to re-enable forwarding.

Doh!

But hey I love it when it's that easy.

Cheers

Pete


-- 
SLUG - Sydney Linux User Group Mailing List - http://slug.org.au/
More Info: http://lists.slug.org.au/listinfo/slug