Rabie van der Merwe
2006-Nov-16 08:51 UTC
Masq but not from a specific src to a specific dst.
Hi, Wonder if this is possible, on some comercial firewalls (pix/checkpoint) you can masq (hide NAT) all outgoing traffic but then you can do exclutions based on a certain source/destinations combo: ie what I want is : (eth1 = dsl eth0 = internal) eth1:192.168.10.0/24 eth0!192.168.0.0/24 eth1 eth0 however it dies with a error: iptables v1.3.5: Unknown arg `--sport'' Try `iptables -h'' or ''iptables --help'' for more information. ERROR: Command "/sbin/iptables -t nat -A ppp0_masq -s 192.168.10.0/24 -d 192.168.0.0/24 --sport 53 -m policy --pol none --dir out -j" Failed So what that will give me is if the internal network 192.168.0.0/24 goes to 192.168.10.0/24 masq will not happen, however if it goes anywhere else on the internet masq will happen. What I used to do on checkpoint was setup hide nat but then in the translation table I set a 192.168.0.0/24 192.168.10.0/24 original original I am currently running shorewall ver 3.2.4 Any help would be appreciated. Regards Rabie ------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net''s Techsay panel and you''ll get the chance to share your opinions on IT & business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
Rabie van der Merwe
2006-Nov-16 09:18 UTC
Re: Masq but not from a specific src to a specific dst.
Sorry I have found my answer, I just had to reread the docs carefully eth1:!192.168.0.0/24 eth0 is all I need. Regards Rabie> Hi, > > Wonder if this is possible, on some comercial firewalls (pix/checkpoint) > you can masq (hide NAT) all outgoing traffic but then you can do > exclutions > based on a certain source/destinations combo: > > ie what I want is : (eth1 = dsl eth0 = internal) > eth1:192.168.10.0/24 eth0!192.168.0.0/24 > eth1 eth0 > however it dies with a error: > iptables v1.3.5: Unknown arg `--sport'' > Try `iptables -h'' or ''iptables --help'' for more information. > ERROR: Command "/sbin/iptables -t nat -A ppp0_masq -s 192.168.10.0/24 > -d 192.168.0.0/24 --sport 53 -m policy --pol none --dir out -j" Failed > > > So what that will give me is if the internal network 192.168.0.0/24 goes > to 192.168.10.0/24 masq will not happen, however if it goes anywhere else > on the internet masq will happen. > > What I used to do on checkpoint was setup hide nat but then in the > translation table I set a > 192.168.0.0/24 192.168.10.0/24 original original > > I am currently running shorewall ver 3.2.4 > > Any help would be appreciated. > > Regards > Rabie > > ------------------------------------------------------------------------- > Take Surveys. Earn Cash. Influence the Future of IT > Join SourceForge.net''s Techsay panel and you''ll get the chance to share > your > opinions on IT & business topics through brief surveys - and earn cash > http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV > _______________________________________________ > Shorewall-users mailing list > Shorewall-users@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/shorewall-users >------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net''s Techsay panel and you''ll get the chance to share your opinions on IT & business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
Rabie van der Merwe wrote:> Hi, > > Wonder if this is possible, on some comercial firewalls (pix/checkpoint) > you can masq (hide NAT) all outgoing traffic but then you can do exclutions > based on a certain source/destinations combo: > > ie what I want is : (eth1 = dsl eth0 = internal) > eth1:192.168.10.0/24 eth0!192.168.0.0/24 > eth1 eth0 > however it dies with a error: > iptables v1.3.5: Unknown arg `--sport'' > Try `iptables -h'' or ''iptables --help'' for more information. > ERROR: Command "/sbin/iptables -t nat -A ppp0_masq -s 192.168.10.0/24 > -d 192.168.0.0/24 --sport 53 -m policy --pol none --dir out -j" FailedThere''s a fix for that bug. See ftp://shorewall.net/pub/shorewall/3.2/shorewall-3.2.4/known_problems.txt It''s the first problem listed. -Tom -- Tom Eastep \ Nothing is foolproof to a sufficiently talented fool Shoreline, \ http://shorewall.net Washington USA \ teastep@shorewall.net PGP Public Key \ https://lists.shorewall.net/teastep.pgp.key ------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net''s Techsay panel and you''ll get the chance to share your opinions on IT & business topics through brief surveys - and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV