Port forwarding, NAT and LAN-to-LAN connections

Port forwarding, NAT and LAN-to-LAN connections

Post by Antonio Rodrigu » Sun, 30 Sep 2001 05:20:48

Hello all,

Here's a stumper. I'm using Debian 2.2 and ipchains to set up a bunch
of services running on a LAN with only one external host doing
port-by-port forwarding to the hosts on the LAN. So,
External IP  forwarded to -->
External IP forwarded to -->

With a couple of simple statements to ipmasqadm:
ipmasqadm portfw -f
ipmasqadm portfw -a -P tcp -L 80 -R 80
ipmasqadm portfw -a -P tcp -L 25 -R 25

this works like a charm in all cases but one-- when the connection is
initiated from a host inside of the LAN. So, if host
tries to connect to, nothing happens. tcpdump shows
that packets are flying about, but the connection is never officially

I suspect that this has to do with the way that MASQ works in linux,
but I am not sure. I have scoured this list and it seems that the only
thing that comes close in posting is this post:

but there was never an acceptable resolution. Using DNS to
short-circuit the firewall's NAT seems kludgey.

Any help would be greatly appreciated.


PS the rest of my rules are set as promiscous as possible for the
purposes of solving this problem:

ipchains -F
ipchains -P input ACCEPT
ipchains -P output ACCEPT
ipchains -P forward ACCEPT
ipchains -P forward -s -j MASQ

and everything else (NAT, forwarding from an external address) is
working jsut fine.


1. IP-Forwarding PPP-LAN but not LAN-LAN


We have a Linux-Server (SuSE6.2) with 2 network-cards (different
TCP/IP-networks on each card).
We cannot allow any IP-Forwarding between these two cards.

Now - the problem is that we also want to use a modem for a PPP-connection
to one of these TCP/IP-networks.
At the moment this is only working when we set IP_FORWARDING to "yes"; but
now the Linux-Server may also
forward IP-traffic between both network cards.

I'm looking for a simple solution to solve this problem.
I haven't yet worked with firewalls, but in my opinion I will need to use

Does anyone have any experiences / hints to help me in this problem?

Thanks in advance

Martin Pauly

2. need barebones system reseller recommendation

3. ftp problem LAN behind NAT/fierwall to LAN

4. WimMark I report for 2.5.70

5. project: samba over a lan-phoneline-lan connection.

6. IDE tape drive

7. Same room LAN to LAN connection

8. man pages on 2.5.1

9. LAN to LAN connection over modems

10. LAN to LAN ppp connection trouble

11. Short distance LAN-LAN connection

12. redirecting all port 80 requests on internal lan to squid proxy on external lan

13. forwarding ftp on LAN...problem: connection time out