Robert Spangler (m...@zoominternet.net)

Shorthand I find the best.
Thnx for the clarification on this.

On Wednesday 31 December 2008 16:05, chloe K wrote:

> ls the network address traslation in centos5.2 different?

Nope.

> I disable the default iptable rule and use the following commands but I
> can't connect http://public:8080 from outside to this host 192.168.0.10
> port 80
>
>    eth1 is public address
>    eth0 is private address 192.168.0.1
>
>    iptables -F -t nat
> iptables --table nat --append POSTROUTING --out-interface eth1 -j
> MASQUERADE iptables --append FORWARD --in-interface eth0 -j ACCEPT
> iptables -t nat -A PREROUTING -p tcp --dport 8080 -i eth1 -j DNAT --to
> 192.168.0.10:80

Your rules are in need of help.
First off  I am not even sure what you are doing will work, i.e.;

--append or --table

These are written as '-A' and '-t'

Try these;

iptables -F -t nat
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
# !!! Following line is wrapped !!!
iptables -t nat -A PREROUTING -p tcp --dport 8080 -i eth1 -j DNAT
--to-destination 192.168.0.10:80
iptables -A FORWARD -i eth0 -j ACCEPT

You could and should tighten these rules up.  You should look into Stateful 
packet inspection for your firewall.  If you are looking to learn how to 
write your own rules use the following;

http://iptables.rlworkman.net/chunkyhtml/index.html

I take it the firewall has 2 interfaces WAN and LAN.  Without knowing how you 
have things setup now you could simple add the following:

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -i <LAN> -s 192.168.1.11 -j DROP
iptables -i <LAN> -s 192.168.1.19 -j DROP
iptables -i <LAN> -s 192.168.1.25 -j DROP

Should any of these ip's need access to the firewall then you nedd to place
those rules before these.

On Tuesday 02 December 2008 17:58, Alexander Farber wrote:

> why does iptables-save print 2 numbers in square brackets?
> Is it used for anything? Is it number of inspected packets
>  (and what's the other number then)?

It is packetand  byte counters.

>  And what does *filter mean?

Not sure

Try this one;

http://www.checkdns.net/quickcheckdomainf.aspx

> And if possible, if it could show any errors, or even make suggestions
> (like "TTL is too high", or " you don't have an MX, please ad one",
>  etc)

TTL's are your choice.  Who better then yourself can say if a TTL is to high 
or to low?  Not every domain has a MX record if they don't have mail so again 
this is up to you.