IPtables + mail + AD

[AndrelaS]

Присоединяюсь к mitox , то что было нужно заработало, на всяк случай выкладываю свои настройки. Всем спасибо!

(Нажмите, чтобы показать/скрыть)

# Generated by iptables-save v1.4.4 on Wed May 12 10:28:00 2010
*nat
:OUTPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
# pop.mail.ru
-A PREROUTING -s 192.168.78.0/24 -p tcp -m tcp -d 192.168.78.201 --dport 9110 -m conntrack --ctstate NEW -j DNAT --to-destination 94.100.177.6:110
-A POSTROUTING -o eth0 -p tcp -m tcp --dport 110 -j SNAT --to-source 192.168.78.201
# smtp.mail.ru
-A PREROUTING -s 192.168.78.0/24 -p tcp -m tcp -d 192.168.78.201 --dport 9025 -m conntrack --ctstate NEW -j DNAT --to-destination 94.100.177.1:25
-A POSTROUTING -o eth0 -p tcp -m tcp --dport 25 -j SNAT --to-source 192.168.78.201
COMMIT
# Completed on Wed May 12 10:28:00 2010
# Generated by iptables-save v1.4.4 on Wed May 12 10:28:00 2010
*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT
# Completed on Wed May 12 10:28:00 2010
# Generated by iptables-save v1.4.4 on Wed May 12 10:28:00 2010
*filter
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
COMMIT
# Completed on Wed May 12 10:28:00 2010

[beast1983]

!!!!Заработало ))

Народ у меня три сетевушки дома на виртуал боксе (CentOS 5.5) все как тут написано получилось на УРА!!!
 но на работе на CentOS 5.5 проделал тоже самое и не хочет !!! в чем может быть причина?
вслючил forward
 в /etc/sysconfig/iptables
прописал но не хочет нахал ,((((
внутреняя сетевушка eth0  192.168.98.1
внутреняя сетевушка eth1 192.168.1.1 (но пока пробую с eth0)
инет сетевушка eth2 192.168.100.101 (шлюз 192,168,100,100)
почта на mail.cbx.ru (89.151.191.14)

sysctl net.ipv4.ip_forward =1


# Generated by iptables-save v1.4.4 on Wed May 12 10:28:00 2010
*nat
:OUTPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
# pop
-A PREROUTING -s 192.168.98.0/24 -p tcp -m tcp -d 192.168.98.1 --dport 9110 -m conntrack --ctstate NEW -j DNAT --to-destination 89.151.191.14:110
#-A POSTROUTING -o eth2 -p tcp -m tcp --dport 110 -j SNAT --to-source 192.168.98.1
#исправил на
-A POSTROUTING -o eth2 -p tcp -m tcp --dport 110 -j SNAT --to-source 192.168.100.101

# smtp
-A PREROUTING -s 192.168.98.0/24 -p tcp -m tcp -d 192.168.98.1 --dport 9025 -m conntrack --ctstate NEW -j DNAT --to-destination 89.151.191.14:25
#-A POSTROUTING -o eth2 -p tcp -m tcp --dport 25 -j SNAT --to-source 192.168.98.1
#исправил на
-A POSTROUTING -o eth2 -p tcp -m tcp --dport 25 -j SNAT --to-source 192.168.100.101

COMMIT
# Completed on Wed May 12 10:28:00 2010
# Generated by iptables-save v1.4.4 on Wed May 12 10:28:00 2010
*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT
# Firewall configuration written by system-config-securitylevel
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 137 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m udp -p udp --dport 138 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 139 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 445 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 23 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 25 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 110 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 9025 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 9110 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 3128 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT


УРааааа все работает!!! блин мелочь, оказывается виртуалка всетаки по другому немного работает!!!