Am 07.01.2014 um 15:01 schrieb Vipul Agarwal <vipul at nuttygeeks.com>: > On Tue, Jan 7, 2014 at 12:28 PM, Nikolaos Milas <nmilas at noa.gr> wrote: > >> Hello, >> >> On CentOS 6.5 x86_64 I have (/etc/sysconfig/iptables): >> >> *filter >> :INPUT ACCEPT [0:0] >> :FORWARD ACCEPT [0:0] >> :OUTPUT ACCEPT [0:0] >> :RH-Firewall-1-INPUT - [0:0] >> -A INPUT -j RH-Firewall-1-INPUT >> -A FORWARD -j RH-Firewall-1-INPUT >> -A RH-Firewall-1-INPUT -i lo -j ACCEPT >> -A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT >> -A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT >> -A RH-Firewall-1-INPUT -m state --state NEW -s 10.10.10.0/24 -m tcp -p >> tcp --dport 22 -j ACCEPT >> -A RH-Firewall-1-INPUT -s 10.10.10.0/24 -m state --state NEW -m tcp -p >> tcp --dport 80 -j ACCEPT >> -A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited >> COMMIT >> >> Now, I want to forward all http traffic coming in from 10.250.250.0/24, >> at local port 8080, to 2 particular IP Addresses (port 80). Is it enough >> to prepend (to the above) the following: >> >> *nat >> :PREROUTING ACCEPT [0:0] >> :POSTROUTING ACCEPT [0:0] >> :OUTPUT ACCEPT [0:0] >> -A PREROUTING -s 10.250.250.0/24 -p tcp --dport 8080 -j DNAT >> --to-destination xxx.xxx.xxx.xxx:80 >> -A PREROUTING -s 10.250.250.0/24 -p tcp --dport 8080 -j DNAT >> --to-destination yyy.yyy.yyy.yyy:80 what is the criteria to distinguish the packets for xxx and yyy? -- LF