FM / html

/usr/share/doc/iptables/html

Name	Size	Mode	Actions
NAT-HOWTO-1.html	1152	0644	edit dl rm
NAT-HOWTO-2.html	4346	0644	edit dl rm
NAT-HOWTO-3.html	1444	0644	edit dl rm
NAT-HOWTO-4.html	4400	0644	edit dl rm
NAT-HOWTO-5.html	5139	0644	edit dl rm
NAT-HOWTO-6.html	8397	0644	edit dl rm
NAT-HOWTO-7.html	1324	0644	edit dl rm
NAT-HOWTO-8.html	1136	0644	edit dl rm
NAT-HOWTO-9.html	2091	0644	edit dl rm
NAT-HOWTO-10.html	2525	0644	edit dl rm
NAT-HOWTO-11.html	910	0644	edit dl rm
NAT-HOWTO.html	2666	0644	edit dl rm
netfilter-extensions-HOWTO-1.html	2102	0644	edit dl rm
netfilter-extensions-HOWTO-2.html	7807	0644	edit dl rm
netfilter-extensions-HOWTO-3.html	28969	0644	edit dl rm
netfilter-extensions-HOWTO-4.html	12548	0644	edit dl rm
netfilter-extensions-HOWTO-5.html	7041	0644	edit dl rm
netfilter-extensions-HOWTO-6.html	11242	0644	edit dl rm
netfilter-extensions-HOWTO-7.html	2188	0644	edit dl rm
netfilter-extensions-HOWTO-8.html	1021	0644	edit dl rm
netfilter-extensions-HOWTO-9.html	2222	0644	edit dl rm
netfilter-extensions-HOWTO.html	7267	0644	edit dl rm
netfilter-hacking-HOWTO-1.html	7474	0644	edit dl rm
netfilter-hacking-HOWTO-2.html	1718	0644	edit dl rm
netfilter-hacking-HOWTO-3.html	8038	0644	edit dl rm
netfilter-hacking-HOWTO-4.html	53338	0644	edit dl rm
netfilter-hacking-HOWTO-5.html	1056	0644	edit dl rm
netfilter-hacking-HOWTO-6.html	3028	0644	edit dl rm
netfilter-hacking-HOWTO-7.html	9288	0644	edit dl rm
netfilter-hacking-HOWTO-8.html	5234	0644	edit dl rm
netfilter-hacking-HOWTO-9.html	835	0644	edit dl rm
netfilter-hacking-HOWTO.html	3811	0644	edit dl rm
packet-filtering-HOWTO-1.html	1891	0644	edit dl rm
packet-filtering-HOWTO-2.html	1593	0644	edit dl rm
packet-filtering-HOWTO-3.html	5775	0644	edit dl rm
packet-filtering-HOWTO-4.html	2189	0644	edit dl rm
packet-filtering-HOWTO-5.html	1644	0644	edit dl rm
packet-filtering-HOWTO-6.html	3505	0644	edit dl rm
packet-filtering-HOWTO-7.html	35616	0644	edit dl rm
packet-filtering-HOWTO-8.html	1457	0644	edit dl rm
packet-filtering-HOWTO-9.html	2333	0644	edit dl rm
packet-filtering-HOWTO-10.html	2575	0644	edit dl rm
packet-filtering-HOWTO-11.html	3742	0644	edit dl rm
packet-filtering-HOWTO.html	2831	0644	edit dl rm

Edit: /usr/share/doc/iptables/html/packet-filtering-HOWTO-9.html (2333B)

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<HTML>
<HEAD>
 <META NAME="GENERATOR" CONTENT="LinuxDoc-Tools 0.9.82">
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <TITLE>Linux 2.4 Packet Filtering HOWTO: Mixing NAT and Packet Filtering</TITLE>
 <LINK HREF="packet-filtering-HOWTO-10.html" REL=next>
 <LINK HREF="packet-filtering-HOWTO-8.html" REL=previous>
 <LINK HREF="packet-filtering-HOWTO.html#toc9" REL=contents>
</HEAD>
<BODY>
<A HREF="packet-filtering-HOWTO-10.html">Next</A>
<A HREF="packet-filtering-HOWTO-8.html">Previous</A>
<A HREF="packet-filtering-HOWTO.html#toc9">Contents</A>
<HR>
<H2><A NAME="s9">9.</A> <A HREF="packet-filtering-HOWTO.html#toc9">Mixing NAT and Packet Filtering</A></H2>

<P>It's common to want to do Network Address Translation (see the NAT
HOWTO) and packet filtering.  The good news is that they mix extremely
well.</P>

<P>You design your packet filtering completely ignoring any NAT you
are doing.  The sources and destinations seen by the packet filter
will be the `real' sources and destinations.  For example, if you are
doing DNAT to send any connections to 1.2.3.4 port 80 through to
10.1.1.1 port 8080, the packet filter would see packets going to
10.1.1.1 port 8080 (the real destination), not 1.2.3.4 port 80.
Similarly, you can ignore masquerading: packets will seem to come from
their real internal IP addresses (say 10.1.1.1), and replies will seem
to go back there.</P>

<P>You can use the `state' match extension without making the packet
filter do any extra work, since NAT requires connection tracking
anyway.  To enhance the simple masquerading example in the NAT HOWTO
to disallow any new connections from coming in the ppp0 interface, you
would do this:</P>
<P>
<BLOCKQUOTE><CODE>
<PRE>
# Masquerade out ppp0
iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE

# Disallow NEW and INVALID incoming or forwarded packets from ppp0.
iptables -A INPUT -i ppp0 -m state --state NEW,INVALID -j DROP
iptables -A FORWARD -i ppp0 -m state --state NEW,INVALID -j DROP

# Turn on IP forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward
</PRE>
</CODE></BLOCKQUOTE>
</P>

<HR>
<A HREF="packet-filtering-HOWTO-10.html">Next</A>
<A HREF="packet-filtering-HOWTO-8.html">Previous</A>
<A HREF="packet-filtering-HOWTO.html#toc9">Contents</A>
</BODY>
</HTML>

cmd: