From: Herbert Poetzl (herbert_at_13thfloor.at)
Date: Wed 07 Sep 2005 - 07:14:47 BST
On Tue, Sep 06, 2005 at 10:15:52PM -0500, Paul Haddad wrote:
> On 9/6/05, Herbert Poetzl <herbert_at_13thfloor.at> wrote:
> > iptables -t nat -I POSTROUTING -s 10.0.0.5 -j SNAT --to 10.33.x.y
> > hope the above is conclusive and helps,
> Yes and no, it does fix the problem (though the to address has to be
> the public IP address of the ppp0 link). But is there any way to not
> specify IP address?
>
> iptables -t nat -I POSTROUTING -j MASQUERADE -s 10.0.0.5
>
> Doesn't work (nor do a half dozen other things I've tried). Yeah I
> know its not a vserver specific question but I'm guessing I'm not the
> only one who's run into this? So maybe its worth an answer so google
> finds it when other people are curious..
some time back there was a patch to do some kind
of 'masquerading' for local/incoming/outgoing connections
but I guess that disappeared ... as it is no masquerading
(because no stateful nat-ing is required)
my question at this point is always: why _not_ specify the
IP address, when you obviously receive it via ppp and set
it with some ppp scripts, if you can easily modify them to
change a single iptables rule, in a custom chain called
for example OUTBOUND, which does nothing else but do this
single SNAT on arbitrary packets ...
then you 'just' have to rewrite the rule above:
iptables -t nat -I POSTROUTING -s 10.0.0.5 -j OUTBOUND
HTH,
Herbert
> --
> Paul Haddad (paul.haddad_at_gmail.com paul_at_pth.com)
> _______________________________________________
> Vserver mailing list
> Vserver_at_list.linux-vserver.org
> http://list.linux-vserver.org/mailman/listinfo/vserver
_______________________________________________
Vserver mailing list
Vserver_at_list.linux-vserver.org
http://list.linux-vserver.org/mailman/listinfo/vserver