rendered paste bodyThe Problem: I need to forward port 25 (smtp) from eth4 (146.145.26.90) to
eth0 (192.168.0.200) on the mail server. The mail server must
see the origin of the connections, so I can't chage the
original src.
**************
******* ********
**** INTERNET ****
******* ********
| ************** |
| |
|- eth4 |- eth2
| ip:146.145.26.90 | ip:216.164.162.139
| gw:146.145.26.89 | gw:216.164.162.137
| |
--------------------------------
| *Firewall Box* | - eth3 ip:192.168.132.1
| Default GW: 216.164.162.137 |-------------------------> To Wireless network
-------------------------------- ip:192.168.132.100-199
|- br0 (Bridge of eth0 and tap0) gw:192.168.132.1
| ip:192.168.0.1
|
|
\ *****
****** *******
** Internal Network ** ------------------> To all workstations
****** ******* ip:192.168.0.100-199
***** gw:192.168.0.1
|
|
|- eth0
| ip:192.168.0.200
| gw:192.168.0.1
------------------------
| *Mail Server* |
| |
------------------------
# iptables-save -c
# Generated by iptables-save v1.3.6 on Tue Sep 25 09:50:37 2007
*mangle
:PREROUTING ACCEPT [2937928:2460714734]
:INPUT ACCEPT [81238:17278997]
:FORWARD ACCEPT [2861996:2444201369]
:OUTPUT ACCEPT [76212:8962498]
:POSTROUTING ACCEPT [2938006:2453151127]
COMMIT
# Completed on Tue Sep 25 09:50:37 2007
# Generated by iptables-save v1.3.6 on Tue Sep 25 09:50:37 2007
*nat
:PREROUTING ACCEPT [42016:2557133]
:POSTROUTING ACCEPT [20150:1296783]
:OUTPUT ACCEPT [10228:453394]
[0:0] -A PREROUTING -s 192.168.132.0/255.255.255.0 -p tcp -m tcp --dport 53 -j DNAT --to-destination 192.168.0.200
[0:0] -A PREROUTING -s 192.168.132.0/255.255.255.0 -p udp -m udp --dport 53 -j DNAT --to-destination 192.168.0.200
[4:240] -A PREROUTING -d 146.145.26.90 -p tcp -m tcp --dport 25 -j DNAT --to-destination 192.168.0.200
[2:120] -A PREROUTING -d 146.145.26.90 -p tcp -m tcp --dport 10001 -j DNAT --to-destination 192.168.0.200
[0:0] -A POSTROUTING -s 192.168.132.0/255.255.255.0 -d 192.168.0.200 -o br0 -p tcp -m tcp --dport 53 -j SNAT --to-source 192.168.0.1
[0:0] -A POSTROUTING -s 192.168.132.0/255.255.255.0 -d 192.168.0.200 -o br0 -p udp -m udp --dport 53 -j SNAT --to-source 192.168.0.1
[144:8424] -A POSTROUTING -s 192.168.0.0/255.255.255.0 -o eth2 -j SNAT --to-source 216.164.162.139
[0:0] -A POSTROUTING -s 192.168.132.0/255.255.255.0 -o eth2 -j SNAT --to-source 216.164.162.139
COMMIT
# Completed on Tue Sep 25 09:50:37 2007
# Generated by iptables-save v1.3.6 on Tue Sep 25 09:50:37 2007
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:RULE_2 - [0:0]
[510:44054] -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
[1730:106901] -A INPUT -i br0 -m state --state NEW -j ACCEPT
[190:80864] -A INPUT -i eth2 -m state --state NEW -j ACCEPT
[0:0] -A INPUT -i eth3 -m state --state NEW -j ACCEPT
[0:0] -A INPUT -i eth4 -m state --state NEW -j ACCEPT
[0:0] -A INPUT -s 192.168.0.0/255.255.255.0 -m state --state NEW -j ACCEPT
[0:0] -A INPUT -s 192.168.132.0/255.255.255.0 -m state --state NEW -j ACCEPT
[0:0] -A INPUT -j RULE_2
[35551:19660073] -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
[196:15605] -A FORWARD -i br0 -m state --state NEW -j ACCEPT
[0:0] -A FORWARD -o br0 -m state --state NEW -j ACCEPT
[0:0] -A FORWARD -i eth2 -m state --state NEW -j ACCEPT
[0:0] -A FORWARD -o eth2 -m state --state NEW -j ACCEPT
[0:0] -A FORWARD -i eth3 -m state --state NEW -j ACCEPT
[0:0] -A FORWARD -o eth3 -m state --state NEW -j ACCEPT
[0:0] -A FORWARD -i eth4 -m state --state NEW -j ACCEPT
[0:0] -A FORWARD -o eth4 -m state --state NEW -j ACCEPT
[0:0] -A FORWARD -s 192.168.0.0/255.255.255.0 -m state --state NEW -j ACCEPT
[0:0] -A FORWARD -s 192.168.132.0/255.255.255.0 -m state --state NEW -j ACCEPT
[2:80] -A FORWARD -j RULE_2
[2257:148686] -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
[0:0] -A OUTPUT -o br0 -m state --state NEW -j ACCEPT
[0:0] -A OUTPUT -o eth2 -m state --state NEW -j ACCEPT
[0:0] -A OUTPUT -o eth3 -m state --state NEW -j ACCEPT
[0:0] -A OUTPUT -o eth4 -m state --state NEW -j ACCEPT
[0:0] -A OUTPUT -s 192.168.0.0/255.255.255.0 -m state --state NEW -j ACCEPT
[0:0] -A OUTPUT -s 192.168.132.0/255.255.255.0 -m state --state NEW -j ACCEPT
[5:200] -A OUTPUT -j RULE_2
[7:280] -A RULE_2 -j LOG --log-prefix "RULE 2 -- DENY " --log-level 6
[7:280] -A RULE_2 -j DROP
COMMIT
# Completed on Tue Sep 25 09:50:37 2007