[Shorewall-users] (S)NAT Question

niels@wxn.nl
Mon, 29 Jul 2002 12:20:03 -0000

I have a firewall set up with these (same :-) 3 zones:

"net" - external adress 212.1.1.1 (fixed IP) network = 212.1.1.0/24
... all
IP''s are useable on the firewall "loc" zone with adress
31.10.5.1 network
31.10.5.0/24
"dsl" zone with adress 10.10.10.10 network 10.10.10.0/24

Now, on the zone "loc" I have a host 31.10.5.126 running a webserver
on port
80...

I wanted to SNAT the (NEW) internet IP adress 212.1.1.2 to this host...

So I changed the /etc/shorewall/nat file

#EXTERNAL       INTERFACE       INTERNAL        ALL INTERFACES
LOCAL
212.1.1.2       eth0            31.10.5.126     yes                     yes

Now it''s forwarding 212.1.1.2 to local adress 31.10.5.126 (all ports
all
protocols)

And IT Works!

Now I wanted to REJECT some protocols/ports, So I edited the
/etc/shorewall/rules file and tried everything, but I din''t even get to
block only one TCP port!

For example block TCP I tried several things

REJECT  net             net:212.1.1.2        tcp
REJECT  net			loc:31.10.5.1        tcp

Or block TCP port 80 I tried

REJECT  net             loc:212.1.1.2:80	   tcp

Nothing worked.....

Question: What is the correct rule in this config?