Extend DNAT rules

[Victor Julien]

DNAT rules can currently only go to a host in the Vuurmuur rules syntax. We should allow not just DNATting traffic to the firewall, but also to a network. This will be hard to do in the rules syntax.

[Victor Julien]

The idea is to enable creating rules like this: $IPTABLES -t nat -A PREROUTING -i $DMZIF -p tcp --dport 5900 -j DNAT --to-destination 192.168.0.100:5900

[Adi Kriegisch]

Replying to victor:

The idea is to enable creating rules like this: $IPTABLES -t nat -A PREROUTING -i $DMZIF -p tcp --dport 5900 -j DNAT --to-destination 192.168.0.100:5900

I think I do not fully grasp?!

[Victor Julien]

Replying to adi:

Replying to victor:

The idea is to enable creating rules like this: $IPTABLES -t nat -A PREROUTING -i $DMZIF -p tcp --dport 5900 -j DNAT --to-destination 192.168.0.100:5900

I think I do not fully grasp?!

In Vuurmuur Portfw and DNAT only work for traffic destined to the firewall itself. Traffic that passed the firewall can not be redirected to a different IP... thats what some ppl need, thats what I'd like to support. More clear?

[Adi Kriegisch]

probably I am not the right person for this... ;-)

[Victor Julien]

We need this to be able to create rules like here at 6.1: ​http://www.faqs.org/docs/Linux-mini/TransparentProxy.html#s6