iptables and redirection

Ok, I have a chain in my IP tables:
*nat
-A PREROUTING -j DNAT --to-destination 10.1.1.21

This is meant to have any system that is connected on the internal
network and tries to go out to the internet get redirected. It works
very well.

What I want to add, though, is to allow a small handful of systems to
bypass that chain and not get their packets redirected to the internal
server. How would I go about this?

Brian Andrus
(E-Mail Removed)

Brian Andrus wrote:

> Ok, I have a chain in my IP tables:
> *nat
> -A PREROUTING -j DNAT --to-destination 10.1.1.21

> What I want to add, though, is to allow a small handful of systems to
> bypass that chain and not get their packets redirected to the internal
> server. How would I go about this?

-I PREROUTING -s 1.2.3.4 -j ACCEPT. The chain is traversed to the first rule
where the packet matches a rule that has target ACCEPT, REJECT or DROP. If
accept, it is then passed on to the next chain (in this case INPUT or FORWARD).

HTH,

-Timo

--
Timo Voipio | Helsinki, Finland | ICBM at: 60 11.800 N 024 52.760 E
GeekCode ver 3: GU>CC d s-: a--- C++ UL(+)$>+++$ P+>+++ L++(+) E- W++ N++
o? K? w O M- V- PS PE Y+ PGP+ t 5++ X R tv- b++(++++) DI+ D G e- h! r !y
Remove +newsharvested to e-mail me | Poista +newsharvested jos meilaat