iptables -t nat -A POSTROUTING -s $DMZ -o eth0 -j MASQUERADE is the only MASQUERADE that is relavant . $DMZ = 192.168.1.0/24 the hq cisco router sits in the dmz. I have listed below the the rules i have in the fire wall that are relavant iptables -A FORWARD -d 192.168.199.253 -j ACCEPT << doesnt work iptables -A FORWARD -s 192.168.199.253 -j ACCEPT << doesnt work iptables -A FORWARD -d 192.168.200.240 -j ACCEPT << works iptables -A FORWARD -s 192.168.200.240 -j ACCEPT << works iptables -A FORWARD -s 192.168.199.0/24 -j DROP iptables -A FORWARD -s 192.168.200.0/24 -j DROP iptables -A OUTPUT -m state --state NEW -o eth1 -j ACCEPT iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -m state --state NEW -o eth1 -j ACCEPT iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT On 7/24/07, Stuart Murray-Smith <eight32@xxxxxxxxx> wrote: > > I have an fc6 box at hq as router / firewall. > > I have a cisco route at the remote site, with 2 ip address on the lan > > interface on in the 192.168.199.254/24 and 192.168.200.254/24 from > > server 192.168.200.240 i can ping google.com, but for 192.168.199.253 > > my tracroute dies on the firewall.. > > > > both ip ranges have the same iptables rules an routing .. why would > > the 192.168.199.253 not be able to access the internet ?? > > Looks like you're NATing on the .200 subnet and not the .199 subnet > > What does your MASQUERADE iptable(s) look like? > > Stu@
Hmmm, I see an eth0 and an eth1. Which device is 192.168.199.253 binding to? And which device is 192.168.200.240 binding to? Stu@
