similar to: DNAT slow performance

Hello there, I''ve got a problem regarding my XEN network setup. First of all, I''ll just tell you what doesn''t work: the access to a forwarded (natted) port (e.g. port 80 http) of a dom (no matter if dom0 or domU) to the servers external ip address (from "inside") does not work (connection refused). Here''s the layout of my xen virtual network:

There are several people out there having problems with SNAT and Xen. I''m having a problem with DNAT and Xen and I think the reason for the problem could be exactly the same. I have actually tracked the problem down to http://lxr.mstier.de/linux/source/net/ipv4/route.c?v=2.6.16.28-xen302#1922 -- xenbr0 is the input device and it has no IP which is why everything coming in from that

I run a Virtual Machine that uses SSH to remote forward Windows File Sharing securely across the net. I need to forward several servers and I map them to different high numbered ports on the SSH server (virtual machine), 10139,10140,10141. The virtual machine is connected to a bridge xenbr0 on the host system that also acts as a router - the server and a single interface on the host machine are

Hello, I''m observing a weird bug with ip_nat_ftp in a somewhat more complicated constellation. It''s possible that XEN is also involved in this, but I''m not sure. What I''m trying to do is have XEN guest domains on a host, connected via a bridge into a private network. The the privileged domain attaches to this private network and acts as a NAT router to connect

Hi, The private adresses (192.168.254.0/255.255.255.0) of my network are sent dynamically by dhcp on my network. The dhcp server is on the firewall which address is 192.168.254.1/255.255.255.255 (this address is static). I''ve got a rsync server on this network which is on a separe server. His address is 192.168.254.200/255.255.255.255 (this address is static). I want that the users

http://bugzilla.netfilter.org/show_bug.cgi?id=763 Summary: dnat and snat not changing port numbers on sctp packets Product: netfilter/iptables Version: linux-2.6.x Platform: x86_64 OS/Version: RedHat Linux Status: NEW Severity: normal Priority: P3 Component: NAT AssignedTo: netfilter-buglog at

https://bugzilla.netfilter.org/show_bug.cgi?id=850 Summary: DNAT applied even after deleting the IP Tables DNAT Rule Product: iptables Version: 1.4.x Platform: All OS/Version: All Status: NEW Severity: major Priority: P5 Component: iptables AssignedTo: netfilter-buglog at

https://bugzilla.netfilter.org/show_bug.cgi?id=1134 Bug ID: 1134 Summary: snat and dnat should accept mapping concatenated values for address and port Product: nftables Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5

https://bugzilla.netfilter.org/show_bug.cgi?id=1225 Bug ID: 1225 Summary: Nft syntax error (snat, dnat using multiple maps) Product: nftables Version: unspecified Hardware: x86_64 OS: Ubuntu Status: NEW Severity: normal Priority: P5 Component: nft Assignee: pablo at

Sorry for the long descritpion of the problem, I''d like to know If I misunderstand something or if I meet an intrinsic limit of my setup. 217.58.51.162 HDSL eth1 - SRV_XP: 192.168.254.10 eth0: 192.168.254.1 -----+------------------+------- 81.121.243.250 ADSL eth3 - I want to allow incoming pptp request (port 1723) to be forwarded to srv_xp

https://bugzilla.netfilter.org/show_bug.cgi?id=920 Summary: DNAT: SNAT: --random and --persistent are not supported Product: nftables Version: unspecified Platform: x86_64 OS/Version: Debian GNU/Linux Status: NEW Severity: normal Priority: P5 Component: nft AssignedTo: pablo at

https://bugzilla.netfilter.org/show_bug.cgi?id=1448 Bug ID: 1448 Summary: SNAT/DNAT/Masquerading not working for UDPLite protocol Product: netfilter/iptables Version: unspecified Hardware: x86_64 OS: other Status: NEW Severity: normal Priority: P5 Component: NAT

I need to access externally (via Internet) one device in internal network which has no default gateway configured. As the device doesn''t have default gateway, the response to SYN (ie, SYN/ACK) don''t come back to Internet. What I need is a setup to make this connection appears to come from firewall''s internal IP address instead of the public IP of originating requester

https://bugzilla.netfilter.org/show_bug.cgi?id=1056 Bug ID: 1056 Summary: nft: Syntax error with dnat as ct state Product: nftables Version: unspecified Hardware: All OS: All Status: NEW Severity: normal Priority: P5 Component: nft Assignee: pablo at netfilter.org

https://bugzilla.netfilter.org/show_bug.cgi?id=1428 Bug ID: 1428 Summary: Unable to dnat to port without defining destination address in inet table Product: nftables Version: unspecified Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 Component:

https://bugzilla.netfilter.org/bugzilla/show_bug.cgi?id=552 Summary: Strange DNAT behaviour... packet don't pass to PREROUTING and go directly in INPUT !! Product: netfilter/iptables Version: linux-2.6.x Platform: i386 OS/Version: All Status: NEW Severity: critical Priority: P2

Hello list, I am in the process of switching from IPCOP to Shorewall s the firewall for our small office. I very much like the fact that Shorewall runs on top of the same OS (openSuSE 11.4) that I run on the server and my desktop. Our setup is fairly straightforward. We have 8 static ip addresses from our ISP, which provides a cable modem and a Cisco 800 series router. The ip addresses are

Hi! First of all, let me say a big "thank you" to Tom for creating shorewall. I''ve been using it for a few months now and it''s such a relief to not have to resort to OpenBSD''s pf (which is so much more sane than Linux'' iptables madness) for the most basic firewalling tasks. I have a question that I didn''t seem to be able to find in the FAQ.

Hello Shorewall gurus, I have a dilemma with a public server. I want to migrate the current public server over to a new machine behind the current server''s firewall (shorewall 1.4). I have included a diagram below to help explain the target network I am working toward. I have read the shorewall online documentation and though I have used Shorewall the past 4 years in the current

Hello all: I''ve got a confusing issue. I had a working shorewall configuration (based on the two interface model) using DNAT for redirection to my HTTP server. The HTTP server is on my inside network (I know - bad juju, but one thing at a time). I changed my configuration this morning to use views in my BIND (named) configuration. Everyone outside the firewall is able to get in