[CentOS] iptables questionson CentOS

Thu Dec 4 12:48:28 UTC 2008
Robert Moskowitz <rgm at htt-consult.com>

Indunil Jayasooriya wrote:
> Hi,
>
> I know these  are a few  iptbales questions. NOT CentOS, anyway, I am
> running a firewall on centos 5.x.
>
> If you can response, it would be fine.
>
>
> I want to add a SNAT rule for one user in LAN to access one particular
> destination on the internet.
>   

May sound a little smug, but get Shorewall and use it to manage your 
iptables rules. It has worked well for me and many others.

> Let's say www.centos.org
>
> I added the below rule. But . it does NOT work
> Pls assume 1.2.3.4 is the real ip of the firewall.
> ip address 192.168.101.230 is the client PC
>
> iptables -t nat -A POSTROUTING -o eth0 -s 192.168.101.230 -j SNAT
> --to-source 1.2.3.4 -d www.centos.org
>
> Any idea to achieve it?
>
> And Also,
>
> the below rule excludes 1 ip. it works fine.
>
> iptables -t nat -A PREROUTING  -p tcp  -m multiport -s ! 192.168.1.9
> --destination-port 80,465,995 -j DNAT --to-destination :3128
>
>  I want to exclude about 4 or 5 ips.
>
>  let's say 192.168.1.11, 192.168.1.19, 192.168.1.20,192.168.1.25
>
>  Is there a way to do it?
>
> Hope to hear from you.
>
>
>
>