🚀 go-pugleaf

I had a client similar to that too.  I threw in an IPCOP box for them, and
took out the firewall

-- 
----------------------------------------------------------------------------
------------------------------------------------------------
"It's all coming back to me now", said the blind man as he peed into the
wind
"Harry Phillips" <harry@hkjsfh.com> wrote in message
news:i7p1t1-n1u.ln1@free.teranews.com...
> I have a client with a firewall device that has a limited interface to
> iptables (I cannot ssh into it either). All you can do is forward a port
> to another IP address, you can't restrict it to a certain source IP.
>
> I have set it up to forward port 22 to my Linux box, that then has
> IPTables to accept anything local and drop everything else except my
> ADSL modem IP.
>
> Now I want to do a similar thing except forward the packets to another
> internal host. I have no idea where to start and what rules to use. The
> setup is:
>
>                   _____________________
>                  |  (firewall device)  |     |---> |192.168.1.50|
> internet <----> |ext_ip  192.168.1.254| <---|---> |192.168.1.1 |
>                  |_____________________|     |---> |192.168.1.x |
>
>
> I want the Linux box (192.168.1.1) to forward port x to 192.168.1.50,
> but only if the source is my ADSL modem IP.
>
> Do I use the NAT and PREROUTING, POSTROUTING, FORWARD? I have examples
> from the Internet if the Linux box and the host it is forwarding to are
> on different networks but not when they are on the same network.
>
> -- 
> Regards,
> Harry Phillips

Black Adder wrote:
> I had a client similar to that too.  I threw in an IPCOP box for them, and
> took out the firewall
> 

That is not an option after paying over $4,000 for it. I just thanks god 
it was not on my advice.

-- 
Regards,
Harry Phillips

perhaps you can utilize firestarter  ?

Harry Phillips wrote:
> 
> I have a client with a firewall device that has a limited interface to
> iptables (I cannot ssh into it either). All you can do is forward a port
> to another IP address, you can't restrict it to a certain source IP.
> 
> I have set it up to forward port 22 to my Linux box, that then has
> IPTables to accept anything local and drop everything else except my
> ADSL modem IP.
> 
> Now I want to do a similar thing except forward the packets to another
> internal host. I have no idea where to start and what rules to use. The
> setup is:
> 
>                   _____________________
>                  |  (firewall device)  |     |---> |192.168.1.50|
> internet <----> |ext_ip  192.168.1.254| <---|---> |192.168.1.1 |
>                  |_____________________|     |---> |192.168.1.x |
> 
> I want the Linux box (192.168.1.1) to forward port x to 192.168.1.50,
> but only if the source is my ADSL modem IP.
> 
> Do I use the NAT and PREROUTING, POSTROUTING, FORWARD? I have examples
> from the Internet if the Linux box and the host it is forwarding to are
> on different networks but not when they are on the same network.
> 
> --
> Regards,
> Harry Phillips

-- 
X-No-Archive: Yes

Harry Phillips <harry@hkjsfh.com> wrote in message news:<i7p1t1-n1u.ln1@free.teranews.com>...
> I have a client with a firewall device that has a limited interface to 
> iptables (I cannot ssh into it either). All you can do is forward a port 
> to another IP address, you can't restrict it to a certain source IP.
> 
> I have set it up to forward port 22 to my Linux box, that then has 
> IPTables to accept anything local and drop everything else except my 
> ADSL modem IP.
> 
> Now I want to do a similar thing except forward the packets to another 
> internal host. I have no idea where to start and what rules to use. The 
> setup is:
> 
>                   _____________________
>                  |  (firewall device)  |     |---> |192.168.1.50|
> internet <----> |ext_ip  192.168.1.254| <---|---> |192.168.1.1 |
>                  |_____________________|     |---> |192.168.1.x |
> 
> 
> I want the Linux box (192.168.1.1) to forward port x to 192.168.1.50, 
> but only if the source is my ADSL modem IP.
> 
> Do I use the NAT and PREROUTING, POSTROUTING, FORWARD? I have examples 
> from the Internet if the Linux box and the host it is forwarding to are 
> on different networks but not when they are on the same network.

I assume you tried DNAT on the PREROUTING chain?
The problem is probably with routing --
your packets from ADSL modem are going to the linux box and
having their destination IP rewritten as .1.50 but the source IP
remains
ADSL so when the .1.50 box replies to these it will send the packets
to ADSL and thus the default router (.1.254) knowing nothing of this
connection drops them.

The trick is to both DNAT on the PREROUTING chain and SNAT on the
POSTROUTING chain (twice nat?)
eg
$IT -t nat -A PREROUTING -j DNAT -p tcp -s $ADSL -d $ALIAS --dport
$PORT --to-destination=192.168.1.50:$PORT

$IT -t nat -A POSTROUTING -j SNAT -p tcp -s $ADSL -d 192.168.1.50
--dport $PORT
--to-source=$ALIAS


Where ALIAS is an IP alias for your linux box and ADSL is your modem
IP.

Good luck.

Sounds like my client too.  I'm not sure how much it was (Cisco PIX
Firewall).  To the end user it made no diiference really, because in the end
they had a solution that worked.

    - I didn't advise them on the Pix Either?

-- 
----------------------------------------------------------------------------
------------------------------------------------------------
"It's all coming back to me now", said the blind man as he peed into the
wind
"Harry Phillips" <harry@hkjsfh.com> wrote in message
news:n012t1-2nv.ln1@free.teranews.com...
> Black Adder wrote:
> > I had a client similar to that too.  I threw in an IPCOP box for them,
and
> > took out the firewall
> >
>
> That is not an option after paying over $4,000 for it. I just thanks god
> it was not on my advice.
>
> -- 
> Regards,
> Harry Phillips

caliban@rootshell.be wrote:
>>
>>Do I use the NAT and PREROUTING, POSTROUTING, FORWARD? I have examples 
>>from the Internet if the Linux box and the host it is forwarding to are 
>>on different networks but not when they are on the same network.
> 
> 
> I assume you tried DNAT on the PREROUTING chain?
> The problem is probably with routing --
> your packets from ADSL modem are going to the linux box and
> having their destination IP rewritten as .1.50 but the source IP
> remains
> ADSL so when the .1.50 box replies to these it will send the packets
> to ADSL and thus the default router (.1.254) knowing nothing of this
> connection drops them.
> 
> The trick is to both DNAT on the PREROUTING chain and SNAT on the
> POSTROUTING chain (twice nat?)
> eg
> $IT -t nat -A PREROUTING -j DNAT -p tcp -s $ADSL -d $ALIAS --dport
> $PORT --to-destination=192.168.1.50:$PORT
> 
> $IT -t nat -A POSTROUTING -j SNAT -p tcp -s $ADSL -d 192.168.1.50
> --dport $PORT
> --to-source=$ALIAS
> 
> 
> Where ALIAS is an IP alias for your linux box and ADSL is your modem
> IP.

Thanks you very much I have tried this and it works exactly they way I 
want it to.

-- 
Regards,
Harry Phillips