Shorewall users - Jul 2002 - NAT or DNAT?

Hi users,
I have installed on a Red Hat 7.3 box, shorewall 1.3.3-1.
I have 3 interfaces: 2 with a static IP conected to a CableModem an the other
conected to my internal net used as a gateway to all the internal boxes.

eth0 192.168.100.24
eth1 24.232.xx.x
eth2 24.232.x.x

Hosts file:
loc    eth0:0.0.0.0/0
mxl   eth0:192.168.100.1
mxe  eth2:24.232.x.x

I put on the masq file:
eth1 192.168.100.0/24  24.232.xx.xx

Add rules... 

DNAT            mxe     mxl:192.168.100.1       tcp     smtp
DNAT            mxe     mxl:192.168.100.1       tcp     imap
ACCEPT          mxe     mxl                     tcp     smtp
ACCEPT          mxl     mxe                     tcp     smtp
ACCEPT          mxe     mxl                     tcp     imap
ACCEPT          mxl     mxe                     tcp     imap
ACCEPT          fw      net                     tcp     53
ACCEPT          fw      net                     udp     53
ACCEPT          loc     fw                      tcp     22
ACCEPT          loc     fw                      tcp     www
ACCEPT          net     fw                      tcp     www
ACCEPT          net     loc                     tcp     www
ACCEPT          fw      net                     tcp     www
ACCEPT          loc     fw                      tcp     smtp
ACCEPT          net     fw                      tcp     smtp
ACCEPT          net     loc                     tcp     smtp
ACCEPT          fw      net                     tcp     smtp
ACCEPT          loc     fw                      tcp     imap
ACCEPT          net     fw                      tcp     imap
ACCEPT          net     loc                     tcp     imap
ACCEPT          fw      net                     tcp     imap

Nat file:
24.232.x.x    eth2    192.168.100.1     No    No

And I have NO problem to conect all of the internal boxes to the outside world.

But, I want to route the smtp and imap trafic from eth2 to eth0:192.168.100.1 to
access to my internal Mail from the outside world but I can''t. My
settings don''t work.

Is correct to use DNAT and NAT at the same time?

I will APPRECIATE IT A LOT.
Thanks in advance.

Guido Estevez

On Thu, 18 Jul 2002, Guido Estevez wrote:
>
> Is correct to use DNAT and NAT at the same time?
>
No, it is not. Your rules for SMTP and IMAP should be simply:

ACCEPT	net	mx1	tcp	smtp
ACCEPT	net	mx1	tcp	imap

BTW: I would strongly suggest imaps rather than imap.

-Tom
--
Tom Eastep    \ Shorewall - iptables made easy
AIM: tmeastep  \ http://www.shorewall.net
ICQ: #60745924  \ teastep@shorewall.net