Hi
I have a RHEL 5.0 server acting a router network which has 4 NIC
NIC1 :10.1.1.1
NIC2 : LIVE IP XXX.YYY.199.1 (XXX.YYY.199.0/24).
NIC3: 192.168.0.1 (connects to the LOCAL LAN PROXY’s)
NIC4: 192.168.15.1 (connects to all servers that are DNAT to LIVE IP from this server and it works fine)

ALL the port are MASQUERADED through NIC1 to the INTERNET

Now I have a LAN PROXY which by itself run network behind itself
i.e RHEL5 server with 2 NIC
NIC1 : 192.168.0.2 having gateway as 192.168.0.1
NIC2 :192.168.10.1 connects to local LAN

I have windows webserver running at port 80 in IP 192.168.10.8 having the gateway as 192.168.10.1

Is it possible to DNAT a live IP XXX.YYY.199.8 to this WINDOWS WEBSERVER (192.168.10.8) to port 80.

Sanjib Gupta

assuming NIC2 = eth1 also must before any drop rules

iptables -t nat -A PREROUTING -p tcp -i eth1 -d XXX.YYY.199.8 --dport 443 -j DNAT --to-destination 192.168.10.8

Thanks for the reply but where do I use this rule in the 1st Server(4 cards) or the 2nd server (2 NIC)

It's plain that according your exposed layout, the *ONLY* server that manages live ips is the "router" (the host with 4 NICS), so putting that rule anywhere else, if ever accepted by iptables, is a wrong assumption, and that's why it should be in this router.

But there's a little "typo" in the iptables rule, because that's for https (port 443), and you want only port 80, so confirm the right NIC and replace the --dport 443 with --dport 80 and it should be fine. Then, don't forget the rule to be loaded with the rest of rules after a reboot.

whoops

thanks