Thank you Rashkae for your correction... >>(and what's with the <<a onclick="return top.js.OpenExtLink(window,event,this)" href="http://10.0.0.2/" target="_blank">http://10.0.0.2</a>>? I can't >>even figure out what you're thinking there.) I don't know where that came from... :) I'm still concerned about the way of doing this, I am trying out some router/firewall distros that i found, ipcop and smoothwall. and i think they could do the job, cos they are web GUI, so NAT rules can be more easily stated, and such as other cool stuff, you should check them out, neither way, Ubuntu is a great distro and I'll be reserching a little bit mo re...maybe <a href="http://shorewall.net">shorewall.net</a> and <a href="http://netfilter.org">netfilter.org</a>, i recently found this <a href="http://ezine.daemonnews.org/200202/multiweb.html">article</a> , and it's kinda what i want. and back to the last email resolution these is the right way of doing DNAT using an old kernel, isn't? /sbin/iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT <div style="direction: ltr;"> --to-destination 10.0.0.2-10.0.0.4</div>/sbin/iptables -t nat -A PREROUTING -p tcp --dport 21 -j DNAT <div style="direction: ltr;">--to-destination 10.0.0.2-10.0.0.4</div> /sbin/iptables -t nat -A PREROUTING -p tcp --dport 25 -j DNAT <div style="direction: ltr;">--to-destination 10.0.0.2-10.0.0.4</div> /sbin/iptables -t nat -A PREROUTING -p tcp --dport 443 -j DNAT <div style="direction: ltr;">--to-destination 10.0.0.2-10.0.0.4</div> and these would be ok under ubuntu 6.06 server, right? /sbin/iptables -A FORWARD -d <a onclick="return top.js.OpenExtLink(window,event,this)" href="http://10.0.0.2/" target="_blank">10.0.0.2</a> -p tcp --dport 80 -j ACCEPT /sbin/iptables -t nat -A POSTROUTING -d <a onclick="return top.js.OpenExtLink(window,event,this)" href="http://10.0.0.2/" target="_blank">10.0.0.2</a> -j SNAT --to <a onclick="return top.js.OpenExtLink(window,event,this)" href="http://10.0.0.1/" target="_blank"> 10.0.0.1</a> if i want to add several entries, meaning several servers FORWARD and POSTROUTING rules, how would be the right way? thank you. <div>On 8/23/07, Rashkae <<a href="mailto:ubuntu@tigershaunt.com">ubuntu@tigershaunt.com</a>> wrote:<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> Victor Padro wrote: > thank you Peter for the info, > anyway, this should be the right way to do it, isn't? > > $ /sbin/iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to > <a href="http://10.0.0.2"> 10.0.0.2</a> > $ /sbin/iptables -t nat -A PREROUTING -p tcp --dport 21 -j DNAT --to > <a href="http://10.0.0.2">10.0.0.2</a> > $ /sbin/iptables -t nat -A PREROUTING -p tcp --dport 25 -j DNAT --to > <a href="http://10.0.0.2">10.0.0.2</a> > $ /sbin/iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to > <a href="http://10.0.0.3">10.0.0.3</a> <<a href="http://10.0.0.2/">http://10.0.0.2/</a>> > $ /sbin/iptables -t nat -A PREROUTING -p tcp --dport 21 -j DNAT --to > <a href="http://10.0.0.3">10.0.0.3</a> <<a href="http://10.0.0.2/">http://10.0.0.2/</a>> > $ /sbin/iptables -t nat -A PREROUTING -p tcp --dport 25 -j DNAT --to > <a href="http://10.0.0.3">10.0.0.3</a> <<a href="http://10.0.0.2/">http://10.0.0.2/</a>> > $ /sbin/iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to > <a href="http://10.0.0.4">10.0.0.4 </a> <<a href="http://10.0.0.2/">http://10.0.0.2/</a>> > $ /sbin/iptables -t nat -A PREROUTING -p tcp --dport 21 -j DNAT --to > <a href="http://10.0.0.4">10.0.0.4</a> <<a href="http://10.0.0.2/">http://10.0.0.2/ </a>> > $ /sbin/iptables -t nat -A PREROUTING -p tcp --dport 25 -j DNAT --to > <a href="http://10.0.0.4">10.0.0.4</a> <<a href="http://10.0.0.2/">http://10.0.0.2/</a>> > No, this is not correct. Incoming packets match one rule only, after which, they stop going down the chain. For example.. all your incoming port 80 packets will hit the first rule, and will therefore never get directed to <a href="http://10.0.0.3">10.0.0.3</a> (and what's with the < <a href="http://10.0.0.2">http://10.0.0.2</a>>? I can't even figure out what you're thinking there.) According to the IPTABLES man page, the correct way to do this is to specify a range of IP addresses in your --to-destination . /sbin/iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 10.0.0.2-10.0.0.4 However, according to the same man page, this is no longer supported since kernel 2.6.10, and I haven't seen any mention anywhere (including <a href="http://www.netfilter.org">www.netfilter.org</a>) on how else one is supposed to do this. Maybe someone could ask Rusty? -- ubuntu-users mailing list <a href="mailto:ubuntu-users@lists.ubuntu.com"> ubuntu-users@lists.ubuntu.com</a> Modify settings or unsubscribe at: <a href="https://lists.ubuntu.com/mailman/listinfo/ubuntu-users">https://lists.ubuntu.com/mailman/listinfo/ubuntu-users</a> </blockquote></div>