From: Erik Smit (smite_at_zylon.net)
Date: Mon 26 May 2003 - 09:22:54 BST
On Mon, May 26, 2003 at 08:45:33AM +0200, Tor Rune Skoglund wrote:
> l?rdag 24. mai 2003, 00:43, skrev du :
> > I'm running my services on a non-routable IP (10.0.0.0/8 in my case) and
> > use DNAT on the external interface to make them reachable from the
> > outside. This works fine (for me).
>
> Could you show us the actual iptables code for that?
Nothing special about it, just a regular DNAT. This is from my
bootscripts:
iptables -A PREROUTING -t nat -i eth0 -d 81.17.52.130 -p tcp --dport 80
-j DNAT --to-destination 10.0.0.1:80
iptables -A PREROUTING -t nat -i eth0 -d 81.17.52.132 -p tcp --dport 80
-j DNAT --to-destination 10.0.0.1:80
vserver main-webserver start
If you also wish to be able to make connections from inside the vserver
to the outside, this will require a SNAT, like so:
iptables -A POSTROUTING -t nat -s 10.0.0.1 -j SNAT --to-source
81.17.52.130
BTW, I'm not running the 10.0.0.1 on the lo device, but on the eth0, so
it is possible to access them from LAN.
Regards,
Erik Smit