why ADD_DNAT_ALIASES missing?

Farkas Levente
Tue, 10 Aug 2004 19:17:13 -0000

hi,
is there any reason why there is no such thing as ADD_DNAT_ALIASES in
shorewall.conf or in rules (or am i just missed it)? i think about it
like in masq file if the masquaraded outgoing interface is different
from the default firewall intyerface than i can use interface:<digit>
where the digit is the alias number. since dnat is in the rules files it
can be used from there. eg: if i would like to dnat all connections from
the internet to an internal machine, that i do:
DNAT net loc:$INTER_IP - - - $EXTER_IP
but i wouldn''t like to add it to the nat file:
$EXTER_IP eth0:5 $INTER_IP
since i wouldn''t like that the internal machine to be able to directly
connect out to the internet, which is the case in the nat file. or am i
miss something? but in this case i''m not able to define that the first
rule should use "5" as alias and not able to force shorewall to add
this
virtual alias automaticaly.
how can i do that or what i misunderstood?
and some related questions:
- is a line in masq file automaticaly add an accept rule too? eg. in
msaq file
eth0 <internal ip>
allow connection from <internal ip> (local zona) to the net zone
(eth0''s
zone)?
- is a line in the nat file automaticaly add an accept rule too? eg. in
nat file:
<external ip> eth0:5  <internal ip>
allow connection from BOTH <internal ip> (local zona) to the net zone
(eth0''s zone) and from the net zone to the <internal ip>?
or should i also have to add these to the rules file?
i try to read all doc but these are not documented very well. some kind
of advanced documentation would be useful for those how know the ip and
iptables command .eg. "a dnat rule add such an iptables command" etc.
thanks in advance.
yours.

--
   Levente                               "Si vis pacem para bellum!"