On Friday 29 August 2008 17:52, Joseph L. Casale wrote:
Postrouting is the correct one. After everything is routed it is MASQ before leaving the interface.
That makes sense, but I am stuck at making the transition, should I simply pull the port specifications from my third line in the FORWARD chain to the first line in the POSTROUTING chain?
iptables -A POSTROUTING -t nat -o $WAN -p tcp -m multiport --dports 80,443 -j MASQUERADE iptables -A FORWARD -i $WAN -o $LAN -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -A FORWARD -i $LAN -o $WAN -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
Does that look groovy?
If your WAN interface is using a public IP and your LAN is using a private IP range then you need to MASQ everything leaving your LAN like this;
iptables -A POSTROUTING -t nat -o $WAN -j MASQUERADE
No port or packet types are needed as everything needs to be MASQed.
There is nothing you need to do to make the transition as all packets go though the Postrouting/Prerouting tables.