Ulrich Dangel wrote:
On Friday 13 February 2009 19:21:10 Thomas Woerner wrote: Hi,
i just got the same idea, so here are some thoughts.
Some Questions: 3) What do you want to do with user-customized firewalls?
I want do to port forwarding for a nat network for statically configured ip addressed.
A solution could be: <network> <name>sample</name> <forward dev='eth0' mode='nat'/> <bridge name='intbr0' stp='on' forwardDelay='0' /> <ip address='192.168.122.1' netmask='255.255.255.0'> <dhcp> <range start='192.168.122.2' end='192.168.122.254' /> <host mac='AA:BB:CC:DD:EE:FF' ip='192.168.122.102'> <port proto='tcp' destip='EXT_IP' dport='80' /> <port proto='tcp' destip='EXT_IP' dport='2202' mapped_port='22'> </host> </dhcp> </ip> </network>
The first mapping could be translatet in something like iptables -A FORWARD -i intbr0 -p tcp -d 192.168.122.102 --dport 80 \ -m state NEW -j ACCEPT iptables -t nat -A PREROUTING -p tcp -s EXT_IP --dport 80 -j DNAT \ --to-destination 192.168.122.102
second one would be
iptables -A FORWARD -i intbr0 -p tcp -d 192.168.122.102 --dport 22 \ -m state NEW -j ACCEPT iptables -t nat -A PREROUTING -p tcp -s EXT_IP --dport 2202 -j DNAT \ --to-destination 192.168.122.102:22
Hope this makes it a little bit clearer what i want to do with user customized firewalls.
What is EXT_IP here? These forward rules are exactly what "lokkit --forward-port=if=<interface>:port=<port>:proto=<protocol>[:toport=<destination port>][:toaddr=<destination address>]" already is doing. The configuration is written to /etc/sysconfig/system-config-firewall and /etc/sysconfig/iptables.
Uli
Thomas