07-01-2012
iptables NAT prerouting & postrouting
Good morning,
I'm a newbie of iptables and as far as I've seen on tutorials on the Internet it seems that both prerouting and postrouting NAT chains are undergone both by a packet that goes from an internal LAN to the Internet and of a one that goes in the opposite direction (from the Internet to the LAN).
AS NAT prerouting is DNAT, i.e. changing of the destination IP address and NAT postrouting is SNAT, i.e. changing of the source IP address, I naturally think that for a packet that exits the internal LAN and goes to the Internet only NAT postrouting is necessary while for a packet that from the Internet goes into the internal LAN only NAT prerouting is necessary.
Can You please take me an example that demonstrates in each of the two cases that also the other NAT chain could be useful (NAT prerouting for a packet that goes from the LAN to the Internet, NAT postrouting for a packet that goes in the opposite direction)?
Please help me!!!
Thank You
Regards
Giacomo Odoardi
10 More Discussions You Might Find Interesting
1. UNIX for Advanced & Expert Users
Hello Guys,
I have a debian machine that work as a firewall (iptables + squid 2.6) with two physical interfaces: eth0 (public interface) and eth1 (internal interface LAN). I have created an alias eth1:1 in order to have two subnets on same physical interface:
cat/etc/network/interfaces
auto... (0 Replies)
Discussion started by: sincity2006
0 Replies
2. IP Networking
Hi Experts;
I want to find the right iptables commands combination to address the following need:
- NEs are NATed thru the linux box (using iptables) towards the WAN cloud, where the NTP servers are situated.
- In order to achieve redundancy, the NTP Servers are in a load balancing cluster... (0 Replies)
Discussion started by: lvl1s7a
0 Replies
3. Debian
Hello, the Nat and the forward worked on my debian server up to the reboot of machines.
The following rules*:
/sbin/iptables -t nat -A PREROUTING -p tcp -i eth2 -d xxx.xxx.xxx.xxx --dport 29070 -j DNAT --to-destination 10.0.1.7:29070
/sbin/iptables -A FORWARD -p tcp -i eth2 -o eth0 -d... (0 Replies)
Discussion started by: titoms
0 Replies
4. IP Networking
Hi ,
My route looks like below:
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.1.253 192.168.1.210 255.255.255.255 UGH 0 0 0 eth2
203.6.21.111 0.0.0.0 255.255.255.252 U 0 0 0 eth0... (1 Reply)
Discussion started by: ashokvpp
1 Replies
5. Red Hat
Hello, please can you help and explain me.
I have two servers. Both are RHEL6.
I use the first one like router and the second one for apache.
Router forwards 80 port on the second server and I can open that from the internet (mysite.com, for example). But I can not open mysite.com if i try to... (0 Replies)
Discussion started by: 6765656755
0 Replies
6. Cybersecurity
Hi, I am learning IPTables have this question.
My server is behind a firewall that does a PAT & NAT to the LAN address.
Internet IP: 68.1.1.23
Port: 10022
Server LAN IP: 10.1.1.23
port: 22
Allowed Internet IPs: 131.1.1.23, 132.1.1.23
I want to allow a set of IPs are to be able to... (1 Reply)
Discussion started by: capri_guy84
1 Replies
7. IP Networking
Hi all,
I have a following situation:
- I want certain source IPs to be natted to a different destination IP and Port. Following is how I am achieving it:
/usr/local/sbin/iptables -t nat -A PREROUTING -p tcp -s 192.168.10.12
--dport 1500 -j DNAT --to-destination 192.168.10.20:2000
... (3 Replies)
Discussion started by: ahmerin
3 Replies
8. IP Networking
Hello,
Recently I discovered an issue with packet routing in the latest Android releases (4.4+ KitKat & Lollipop).
It seems that the problem Android specific, but essentially it comes from the Linux kernel.
I already filed a bug report to Google. You can see the details by searching for... (0 Replies)
Discussion started by: Vladislav
0 Replies
9. IP Networking
Hi guys
I'm running on debian on a small embedded system. I have a ppp interface that is connected to the internet (and works). My unit also has wifi access point (which works and I can connect to it).
I want to allow connections to the wifi to be able to use the internet from ppp0... (1 Reply)
Discussion started by: alirezan1
1 Replies
10. Cybersecurity
good day good people
hi
first to tell that firewall and vpn is working as expected, but I notice something strange.
I have host system 11.11.11.11(local ip) firewall is blocking everything except port to vpn.
I have vpn on virtualized system 22.22.22.22 (CentOS both host and virtual). ... (0 Replies)
Discussion started by: end
0 Replies
LEARN ABOUT REDHAT
ip6tables-save
IPTABLES-SAVE(8) iptables 1.6.1 IPTABLES-SAVE(8)
NAME
iptables-save -- dump iptables rules to stdout
ip6tables-save -- dump iptables rules to stdout
SYNOPSIS
iptables-save [-M modprobe] [-c] [-t table]
ip6tables-save [-M modprobe] [-c] [-t table]
DESCRIPTION
iptables-save and ip6tables-save are used to dump the contents of IP or IPv6 Table in easily parseable format to STDOUT. Use I/O-redirect-
ion provided by your shell to write to a file.
-M, --modprobe modprobe_program
Specify the path to the modprobe program. By default, iptables-save will inspect /proc/sys/kernel/modprobe to determine the exe-
cutable's path.
-c, --counters
include the current values of all packet and byte counters in the output
-t, --table tablename
restrict output to only one table. If not specified, output includes all available tables.
BUGS
None known as of iptables-1.2.1 release
AUTHORS
Harald Welte <laforge@gnumonks.org>
Rusty Russell <rusty@rustcorp.com.au>
Andras Kis-Szabo <kisza@sch.bme.hu> contributed ip6tables-save.
SEE ALSO
iptables-apply(8),iptables-restore(8), iptables(8)
The iptables-HOWTO, which details more iptables usage, the NAT-HOWTO, which details NAT, and the netfilter-hacking-HOWTO which details the
internals.
iptables 1.6.1 IPTABLES-SAVE(8)