Hello,

We have slight issue with traffic redirection.

So, we have mail server M, we have web server W. M and W are in different networks. Moreover, W is openVZ VE.

What we want to achieve is to have following scenario:

W:25 -> M:25
W:143 -> M:143
W:993 -> M:993

We tried acomplishing this with adding following rules on W:
A PREROUTING -d W/32 -i venet0 -p tcp -m tcp --dport 25 -j DNAT --to-destination M:25
-A PREROUTING -d W/32 -i venet0 -p tcp -m tcp --dport 143 -j DNAT --to-destination M:143
-A PREROUTING -d W/32 -i venet0 -p tcp -m tcp --dport 993 -j DNAT --to-destination M:993

Now, when trying to connect to W:25, it feels as if connection request is sent to W but answer from W is not sent back to requester.

Any clues?

Exact setup works perfectly if M is in same subnet (another VE).
Thanks.

Like always. Answer is found as soon as issue posted

There was missing SNAT rule:
iptables -t nat -A POSTROUTING -d M -p tcp --dport 25 -j SNAT --to-source W
iptables -t nat -A POSTROUTING -d M -p tcp --dport 143 -j SNAT --to-source W
iptables -t nat -A POSTROUTING -d M -p tcp --dport 993 -j SNAT --to-source W

maybe someone might find this useful. regards.