Hi Everyone

I am using Redhat Enterprise Edition ,Here i want to make the linux machine as

the NAT server by using the iptables

That is the resquest comming from the outside as the public ip ,its should

NAT to local ip address

So how can i do that

Helping me in this problem will be greatly appriciated

Example

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to 10.2.2.1:8080

The example above nats all the requests arriving at the external interface of the Linux router to an internal webserver at port 8080.

Example

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to 10.2.2.1:8080

The example above nats all the requests arriving at the external interface of the Linux router to an internal webserver at port 8080.
If you need something more specific I am glad to help you out just state more info, and in case you might wonder where to get excellent information examples and tutorials about IPTABLES, check out this tutorial it is the one tutorial I recommend most and it is the one tutorial that catapulted me into the world of iptables.

http://www.linuxsecurity.com/resourc...-tutorial.html

Apart from the example rule ALInux have mentioned, you got enable (echo 1 >> /proc/sys/net/ipv4/ip_forward) packet forwarding at your kernel & you got to make sure that local ip address to whom you are forwarding these packets should have your linux router's LAN IP as its gateway.

Thanks for your clear and superb explanation

ok thats fine


For example if i want use other ip that i have free


Asuume that i have 3 public ip

one that is used for the Linux firewall and router

The other two i have to use for mail webserver and ssh

running in the differrent machine in local area networK

What i waant to do

Helping this issue will be greatly appriciated

Thanks
Winxandlinx

If you incase opt for using 3 different public ips at your LAN boxes (with bridging being done at your router/modem) then you do not need any port forwarding in this case. The basic usage of port forwarding or packet forwarding or tunelling or ip forwarding comes when you have a limitation of nos of public ips. In this case every single port of this real public ip serve us as another public ip(logically). For example; suppose i only have 1 real ip & i want to host webserver, ftp server, terminal server(services) & i have all of these 3 services running at physically different boxes, so with port forwarding i would map port 80 of my real ip to LAN-hosted webserver & for ftp server i would map 21 port of my real-ip to the other different LAN-hosted ftp server further as i got to make my internet users do remote logon with terminal services; i'll map 3389 port of my real ip to terminal server hosted inside my LAN.

In the other case; if i would have had 3 public ip's then i would make them physically available at those LAN hosted boxes by adding another ethernet interface & hence no PORT FORWARDING.

I've written more about this at http://amitsharma.linuxbloggers.com/portforwarding.htm

ya i understand

But i dont want to use more than two lan cards in the firewall

(one is for Public ip and other one is for LOcal private ip)

Want i want do is the request comes for the other two public ips

It should get regonise by the iptables firewall

like one to one static nating ( i think so it can be done )

But only one Public ip is physically present in the lan card

May be other two Public ips are virtual

Until & unless either you confirm you have got these other two real ips as virtual or you create them & see packets coming to them; you cant expect iptables to do any static NATing for you for these 2 other real ips.

Hi Amit

Thanks for you reply

See i have three ips from isp

(what i mean by vitually is which is not physicallyy assigned to the

lan card)

But i want to use static nating

Like the way you have mapped(bridging) one of your real ip to your LAN card, you got to map other also or if you do not want to perform these steps(as you have stated in your last post); you got to do NATing at your DSL router/modem. You got to tell your a/dsl modem/router to forward all the packets recieved at your other two real ips to forward to some LAN box or this box.

You are describing a situation where you have a WAN zone, and LAN network and a DMZ zone with a public web server and an ftp server. I would recommend using three interfaces, one for each zone, or configure those servers as bastion hosts in the Internet zone and place the FC firewall between the internet zone and the LAN. The two servers each having the IP address assigned to them that the ISP provided. The third IP address could then be NAT'ed like you would for network sharing. In other words, don't have a LAN-hosted webserver unless it is only used inside the LAN.
Besides security concerns, you also want to keep heavy traffic out of the LAN.

Please find the image below that i made to represent

the thing that i told you
http://i80.photobucket.com/albums/j1...lefirewall.jpg

I think that this would be a much safer configuration.

Instead of a Telnet server, using different ports for ssh to differentiate between local hosts would be a better Idea. Never use telnet, unless you are just using the client program and you are connecting to the device directly through a dedicated terminal port, such as on a Cisco router for example. If you want to use TightVNC Remote desktops, you can also configure each host to use a different port. This is often done when you instead have several thin clients connecting to a central application server for example. If you want to use ftp on a host on LAN, consider using sftp instead. You have the ssh ports open anyway.

Use one public IP address for the Web Server. If FTP is on another server, use the second IP address for that and NAT the third for the LAN hosts. This could be done in the Firewall, but having a second NAT router or firewall would be safer.
Otherwise mistake in the Firewall could leave your LAN naked to attack. The Web Server and the FTP server could also have their own internal firewalls. The more onion like layers of security the better.
firewall set up so that only the the port they serve is open.

Ya i can understand butits for my neigbours company

Even i can understand puting DMZ zone will be good

Design Security pratice,But there is no administrator

in company

So the complex we do more on setup will be problem

for them to manage

Thats what the problem

Now i question is the design in image ,whatr i sended

can be done in iptables or it wont be possible


Thats what