Extend DNAT rules

[victor]

DNAT rules can currently only go to a host in the Vuurmuur rules syntax. We should allow not just DNATting traffic to the firewall, but also to a network. This will be hard to do in the rules syntax.

[victor]

The idea is to enable creating rules like this:
$IPTABLES -t nat -A PREROUTING -i $DMZIF -p tcp --dport 5900 -j DNAT --to-destination 192.168.0.100:5900

[adi]

Replying to victor:

The idea is to enable creating rules like this:
$IPTABLES -t nat -A PREROUTING -i $DMZIF -p tcp --dport 5900 -j DNAT --to-destination 192.168.0.100:5900

I think I do not fully grasp?!

[victor]

Replying to adi:

Replying to victor:

The idea is to enable creating rules like this:
$IPTABLES -t nat -A PREROUTING -i $DMZIF -p tcp --dport 5900 -j DNAT --to-destination 192.168.0.100:5900

I think I do not fully grasp?!

In Vuurmuur Portfw and DNAT only work for traffic destined to the firewall itself. Traffic that passed the firewall can not be redirected to a different IP... thats what some ppl need, thats what I'd like to support. More clear?

[adi]

probably I am not the right person for this... ;-)

[victor]

We need this to be able to create rules like here at 6.1:
​http://www.faqs.org/docs/Linux-mini/TransparentProxy.html#s6