Changing outbound IP addresses

Hello,

I want to set up my router so any request going to any ip address on
port 25 instead goes to my internal SMTP server. IE, if I do a "telnet
66.167.1.230 25", packets should instead be sent to "192.168.1.1 25".

Do I use the OUPUT chain or the FORWARD chain to do this? Is this DNAT?
Do I have to use stateful packet filtering or can I get by without it?

Just give me a general idea of what to do, I can look up the details on
google.

- Steve

Hi Steve -

On 25 Dec 2004 11:05:46 -0800, (E-Mail Removed) wrote:

>I want to set up my router so any request going to any ip address on
>port 25 instead goes to my internal SMTP server. IE, if I do a "telnet
>66.167.1.230 25", packets should instead be sent to "192.168.1.1 25".
>
>Do I use the OUPUT chain or the FORWARD chain to do this? Is this DNAT?
>Do I have to use stateful packet filtering or can I get by without it?
>
>Just give me a general idea of what to do, I can look up the details on
>google.

I'm assuming that the router and server are two different systems.
Yes, you want PREROUTING DNAT to change the destination IP address.
The FORWARD chain needs to ACCEPT the packets going both directions.

--
Ken
http://www.ke9nr.net/

Ken wrote:
>
> On 25 Dec 2004 11:05:46 -0800, (E-Mail Removed) wrote:
>
>>I want to set up my router so any request going to any ip address on
>>port 25 instead goes to my internal SMTP server. IE, if I do a "telnet
>>66.167.1.230 25", packets should instead be sent to "192.168.1.1 25".
>>
>>Do I use the OUPUT chain or the FORWARD chain to do this? Is this DNAT?
>>Do I have to use stateful packet filtering or can I get by without it?
>
> I'm assuming that the router and server are two different systems.
> Yes, you want PREROUTING DNAT to change the destination IP address.
> The FORWARD chain needs to ACCEPT the packets going both directions.

To prevent asymmetric routing, he'll also need a DNAT rule in the
POSTROUTING chain. Assuming that the SMTP server and the workstations
generating SMTP traffic are on the same subnet, of course.

On Sat, 25 Dec 2004 11:05:46 -0800, steve wrote:

> Hello,
>
> I want to set up my router so any request going to any ip address on
> port 25 instead goes to my internal SMTP server. IE, if I do a "telnet
> 66.167.1.230 25", packets should instead be sent to "192.168.1.1 25".
>
> Do I use the OUPUT chain or the FORWARD chain to do this? Is this DNAT?
> Do I have to use stateful packet filtering or can I get by without it?
>
> Just give me a general idea of what to do, I can look up the details on
> google.
>
> - Steve

From memory you'll require both prerouting and postrouting rules. I have
a working solution at work and could dump the config here for you if you
like.

Make sure you check for open relays from an external source once you've
got everything configured. If the tables aren't configured correctly,
external packets may appear as if they are internal and therefore sendmail
will accept and relay all traffic.

Ben.