Hy lartc members,
I only ACCEPT 7 IP''s in FORWARD chain, filtering by IP and MAC.
Everything worked fine until i needed to forward ports. The problem is
that the nat PREROUTING chain is traversed before the filter FORWARD
chain and this way the packets change their source and are not
allowed to pass FORWARD that is restricted to only 7 IPs.
I use this rules to forward the port:
iptables -t nat -A PREROUTING -p tcp --dport <port> -i <external
NIC> -j DNAT --to <ip_intern>:<port> -d <ip_extern>
iptables -t nat -A PREROUTING -p udp --dport <port> -i <external
NIC> -j DNAT --to <ip_intern>:<port> -d <ip_extern>
and this on the FORWARD chain that has a default policy to DROP
iptables -A FORWARD -i <internal NIC> -s 192.168.1.1 -m mac --mac-source
xx-xx-xx-xx-xx-xx -j ACCEPT
Can I identify the marked packets to use them in iptables rules? This would help
in this situation because the pakets traverse first the mangle table, get
marked, then traverse the nat table where the source ip is changed and in the
filter table if would be posible to use the marks i wowld identify the packets
even if the source ip is changed.
Regards
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
