Shorewall users - Apr 2005 - DNAT/Redirect Question

Hi all,

I have a group of public IPs 80.x.x.209-80.x.x.215. My satellite broadband
router has .209 and my Fedora Core 2 running Shorewall firewall has one network
card with IP .210 and the other with 172.16.0.1/255.255.0.0. All network PCs
have a 172.16.x.x private address.

I am new to shorewall and fedora/linux. I would like requests to public IP
80.x.x.211 to be redirected to internal IP 172.16.0.2 (for all traffic to all
ports)

Is this possible? If so how?

Thanks in advance,

David T. Thomas
(Fedora newbee;)

David,
I needed to do this and achieved it as follows :
In the file /etc/shorewall/nat :
80.x.x.211     <external adapter>    172.16.10.2  Yes     Yes 
In the rules file
ACCEPT  INET    LOC:172.16.10.2       all

I am not sure if this is the best way to do this.

Sushesh
-----Original Message-----
From: shorewall-users-bounces@lists.shorewall.net
[mailto:shorewall-users-bounces@lists.shorewall.net] On Behalf Of David
T. Thomas
Sent: Monday, April 25, 2005 2:50 PM
To: shorewall-users@lists.shorewall.net
Subject: [Shorewall-users] DNAT/Redirect Question


Hi all,

I have a group of public IPs 80.x.x.209-80.x.x.215. My satellite
broadband router has .209 and my Fedora Core 2 running Shorewall
firewall has one network card with IP .210 and the other with
172.16.0.1/255.255.0.0. All network PCs have a 172.16.x.x private
address.

I am new to shorewall and fedora/linux. I would like requests to public
IP 80.x.x.211 to be redirected to internal IP 172.16.0.2 (for all
traffic to all ports)

Is this possible? If so how?

Thanks in advance,

David T. Thomas
(Fedora newbee;)

_______________________________________________
Shorewall-users mailing list
Post: Shorewall-users@lists.shorewall.net
Subscribe/Unsubscribe:
https://lists.shorewall.net/mailman/listinfo/shorewall-users
Support: http://www.shorewall.net/support.htm
FAQ: http://www.shorewall.net/FAQ.htm

Sushesh wrote:
> David,
> I needed to do this and achieved it as follows :
> In the file /etc/shorewall/nat :
> 80.x.x.211     <external adapter>    172.16.10.2  Yes     Yes 
> In the rules file
> ACCEPT  INET    LOC:172.16.10.2       all
> 
> I am not sure if this is the best way to do this.
The above will also perform SNAT -- all connetions from 172.16.10.2 to the
net will appear to come from 80.x.x.211.

If you only want DNAT then in /etc/shorewall/rules:

DNAT	net	loc:172.10.10.2	all

-Tom
-- 
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@shorewall.net
PGP Public Key   \ https://lists.shorewall.net/teastep.pgp.key