Re: [Ebtables-user] ebt_snat patch

Bart De Schuymer wrote:

>On Sunday 06 July 2003 16:33, Dmitry B. Khlonin wrote:
>  
>
>>I have patched kernel_source/net/bridge/netfilter/ebt_snat.c file
>>to have working full ethernet dnat of boxes behind the firewall.
>>For example - these lines working as expected
>>EBTABLES -t nat -A PREROUTING  -p ipv4 -i $EIF -d $MACE  --ip-dst     $IIP1
>>-j dnat --to-destination $MACI1 ebtables -t nat -A POSTROUTING -p ipv4 -o
>>$EIF -s $MACI1 --ip-src     $IIP1 -j snat --to-source $MACE ebtables -t nat
>>-A POSTROUTING -p ARP  -o $EIF -s $MACI1 --arp-ip-src $IIP1 -j snat
>>--to-source $MACE
>>
>>in last line we not only set mac-address of outcoming packet to mac-address
>>of external interface but also change mac of sender in the ARP packet to
>>mac-address of external interface.
>>    
>>
>
>I think it's best to make an option out of this,  so the user can decide to do 
>this or not. I'll put it on the todo list.
>
>  
>
It can be done by creating these rules and consider ARP mangling too 
then SNAT-ting.

P.S. There's no userspace utility for arptables code in the kernel.




-------------------------------------------------------
This SF.net email is sponsored by: VM Ware
With VMware you can run multiple operating systems on a single machine.
WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines at the
same time. Free trial click here: http://www.vmware.com/wl/offer/345/0