On 06/09/2012 08:11 AM, Aaron St. Pierre wrote: > Thanks Tom. Could you explain this a bit more or point me in the right > direction to the documentation? >
Please don't top-post, Aaron. Refer to the diagram at http://www.shorewall.net/NetfilterOverview.html. Entries in /etc/shorewall/nat file add rules to the PREROUTING chain of the nat table. Those rules rewrite the destination IP address in the packet to the address of a host in your local network (192.168.x.x in your case). That means that when the 'routing decision' occurs, the packet will be sent up through the FORWARD and POSTROUTING chains. With respect to the rules file, these will be controlled by rules of the form: XXX net loc:192.168.x.x proto port - 64.22.y.y which are added to the FORWARD chain of the filter table. Rules like this: DROP net $FW:... are added to the INPUT chain of the filter table. As noted above, packets that are NATted by /etc/shorewall/nat aren't sent through that chain. The ACCEPT+, DNAT, NONAT and REDIRECT rules insert rules into the PREROUTING chain of the nat table *ahead of* the nat rules added by /etc/shorewall/nat. They therefore override those rules and can allow connections to be directed to the firewall rather than the system in the local network. HTH, -Tom -- Tom Eastep \ When I die, I want to go like my Grandfather who Shoreline, \ died peacefully in his sleep. Not screaming like Washington, USA \ all of the passengers in his car http://shorewall.net \________________________________________________ ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ _______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
