Re: why ADD_DNAT_ALIASES missing?

Tom Eastep
Tue, 10 Aug 2004 16:43:46 -0000

| hi,
| is there any reason why there is no such thing as ADD_DNAT_ALIASES in
| shorewall.conf or in rules (or am i just missed it)?

It is not there because I haven''t implemented it.

| i think about it
| like in masq file if the masquaraded outgoing interface is different
| from the default firewall intyerface than i can use ip:<digit> where the
| digit is the alias number. since dnat is in the rules it can be used
| from there. eg: if would like to dnat all connection from the internet
| to an internal machine, that i do:
| DNAT net loc:$INTER_IP - - - $EXTER_IP
| but i wouldn''t like to add it to the nat file:
| $EXTER_IP eth0:5 $INTER_IP
| since i wouldn''t like that the internal machine to be able to
directly
| connect out to the internet, which is the case in the nat file. am i
| miss something? but in this case i''m not able to define that the
first
| rule should use "5" as alias and not able to force shorewall to add
this
| virtual alias automaticaly.
| how can i do that or what i misunderstood?

You must add the alias manually -- your distribution most likely has a
way to do that. Then you can do DNAT based on the original destination
addrss as described at
http://shorewall.net/Shorewall_and_Aliased_Interfaces.html in the
section entitled DNAT.

- -Tom
- --
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@shorewall.net

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFBGPtCO/MAbZfjDLIRAk7DAJ4/v05X8Ie6qwWBFAal2Pn+rM44MwCgvLi5
Q+FIlc1Q7X+XvE72Wxx9Byc=HGEO