Hi,

I'm using my Linux box 191.162.209.12 as default gateway for my Mac 191.162.209.20

191.162.209.0 is my local subnet and the Linux box has full access to the (fully trusted) remote subnet 51.121.0.0 through ppp0:

Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
51.121.92.12 0.0.0.0 255.255.255.255 UH 40 0 0 ppp0
191.162.209.0 0.0.0.0 255.255.255.192 U 40 0 0 eth0
51.121.0.0 51.121.92.12 255.255.0.0 UG 40 0 0 ppp0
0.0.0.0 191.162.209.1 0.0.0.0 UG 40 0 0 eth0

The linux box gets assigned 51.121.98.254 as local IP on ppp0.



Now I want to login to lets say another unix machine at 51.121.44.25 from my Mac and open an Xwin application. 51.121.44.25 does not support ssh.


iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE -d 51.121.0.0/16

allows me to directly access 51.121.44.25 masqueraded from my Mac at 191.162.209.20, but I don't know how I can forward incoming Xwin ports so that the Xwin connection from 51.121.44.25 to 191.162.209.20 becomes possible.

I tried

iptables -A PREROUTING -t nat -p tcp -s 51.121.0.0/16 --dport 6000:6099 -d 51.121.98.254 -i ppp0 -j DNAT --to 194.162.209.20

to forward all Xwin ports from the remote network to my Mac, but still a connection is not possible :-(


I guess I missed a couple of ports, but I don't know which. Also I don't know how to get appropriate debug messages to find the correct way myself :-((

Is anyone out there willing to point me into the right direction?

Ingo

Sorry for the delay in replying but your post looked a bit too confusing, but I think I see the problem now

Why do you do NAT for the 51.121.0.0 network ?
It's a real addresses in your routing table so the packets should be forwarded like a router would.

you should be able to ping it from your mac without nat, also the ports don't need to be DNAT back, just allow your firewall to accept input from the 51.121.0.0/16 subnet with port ranges from 6000 to 6300 and all outputs from port 1023:65535 to 1023:65535

/raz

>Why do you do NAT for the 51.121.0.0 network ?

Well, the linux box only has one remote IP (51.121.98.254), since this is a single PPP dial-in connection only into the 51.121.0.0 net.

I cannot change Routing for "external IPs" in the 51.121.0.0 net (like for my Mac 191.162.209.20), therefore I must use my internal ip 51.121.98.254 to connect back to my systems from 51.121.44.25 ...

Ingo