[Shorewall-users] static NAT

Tom Eastep
Sat, 09 Aug 2003 18:28:25 -0000

On Sat, 9 Aug 2003, Tom Eastep wrote:

>
> Install today''s snapshot then overlay
/usr/share/shorewall/firewall with
> the firewall file from CVS and move the "accounting" file from
CVS to
> /etc/shorewall/accounting. Basic instructions for setting up the file
> are contained therein.
>

Oh -- and when setting up your /etc/shorewall/accounting file, forget that
you even have static NAT. Count packets/bytes to/from the external
interface and each of the 13 internal systems.

The accounting is done in Netfilter''s ''filter'' table
which means that DNAT
has already been applied on input packets and SNAT hasn''t yet been
applied
on output packets. In other words, the IP addresses of your alias
interfaces will match neither the source nor destination address of any
of the internet traffic generated by the gang of 13...