Very Computer

For instance, my RedHat 7.2 box has 2 NIC:
eth0=1.2.3.4(externet ip)
eth1=10.1.1.1(internal ip)

Another MS IIS web server=10.1.2.1

I tried to use iptables to do redirect http://1.2.3.4 to above
internal web server but failed. I used the following script:

iptables -t nat -A PREROUTING -i eth0 -p tcp --destination-port 80 -j
DNAT --to-destination 10.1.2.1:80

Anybody can give me an useful script to allow me to do so?

Thanks in advance

Willie

Quote:> For instance, my RedHat 7.2 box has 2 NIC:
> eth0=1.2.3.4(externet ip)
> eth1=10.1.1.1(internal ip)

> Another MS IIS web server=10.1.2.1
> I tried to use iptables to do redirect http://1.2.3.4 to above
> internal web server but failed. I used the following script:
> iptables -t nat -A PREROUTING -i eth0 -p tcp --destination-port 80 -j
> DNAT --to-destination 10.1.2.1:80

Quote:> Anybody can give me an useful script to allow me to do so?

iptables -A FORWARD -m state --state ESTABLISHED -j ACCEPT
iptables -A FORWARD -m state --state NEW -p tcp -d 10.1.2.1 --dport 80 \
        -i eth0 -o eth1 -j ACCEPT

Otherwise, DNAT will be OK, but packets will be dropped by FORWARD
chain.

--
 BC> je ne fais rire que les dinos
 Mais vous faites gerber tous les autres.
 -+-AC in <http://neuneu.mine.nu> : Dp?t de gerbe -+-

Quote:>>iptables -t nat -A PREROUTING -i eth0 -p tcp --destination-port 80 -j
> DNAT --to-destination 10.1.2.1:80
> Maybe you should add -d 1.2.3.4 (external IP).

> > Anybody can give me an useful script to allow me to do so?

> Are your FORWARD rules convenient for this stuff ? I mean, do you have
> ACCEPT policy or such rules :

> iptables -A FORWARD -m state --state ESTABLISHED -j ACCEPT
> iptables -A FORWARD -m state --state NEW -p tcp -d 10.1.2.1 --dport 80 \
>    -i eth0 -o eth1 -j ACCEPT

> Otherwise, DNAT will be OK, but packets will be dropped by FORWARD
> chain.

I entered the following command after reboot, but still failed.....

iptables -A FORWARD -m state --state ESTABLISHED -j ACCEPT
iptables -A FORWARD -m state --state NEW -p tcp -d 10.1.2.1 --dport 80 \
    -i eth0 -o eth1 -j ACCEPT
iptables -t nat -A PREROUTING -i eth0 -p tcp -d 1.2.3.4 --dport 80 -j \
    DNAT --to 10.1.2.1:80

Is there something I still missed?

Please help~~~

Best Regards,

Willie