preklad domeny za natem

[Cepela]

Obracim se opet na zdejsi komunitu s prosbou o pomoc. Mam sit kterou routuji do sveta pomoci gw na debianu s iptables. V teto siti jsou stanice a jeden mailserver na ubuntu s ip 192.168.1.25. Z vnejsku na nej pristupuji bez problemu pres domenu napr mail.aaa.cz a vse bezi ok (webmail, imap, smtp,....). Stolni pc uvnit site maji nastavenou adresu primo, tj. 192.168.1.25 a taky pracuji OK. Problem ale nastane, kdyz ma nekdo notebook a potrebuje pristupovat jak zvenci, tak zevnitr, protoze musi mit nastavenu v mailovem klientu domenovou adresu, ktera se ale spravne nepresmeruje kdyz je uvnit - pri pristupu uvnitr site na mail.aaa.cz se to neproroutuje spravne na 192.168.1.25, ale patrne se to zamota na gw. Da se toto nejak obejit? V jine siti mam mailserver zaroven jako gw a tam se to pomlati OK i zevnitr, ale tady ne. Projistotu pridavam iptables z gw:

Kód: [Vybrat]

# Generated by iptables-save v1.4.2 on Wed May 11 11:48:08 2011
*mangle
:PREROUTING ACCEPT [261490383:122539398190]
:INPUT ACCEPT [20363847:3493207943]
:FORWARD ACCEPT [241098617:119043855803]
:OUTPUT ACCEPT [21846235:8651538356]
:POSTROUTING ACCEPT [262269622:127623941631]
COMMIT
# Completed on Wed May 11 11:48:08 2011
# Generated by iptables-save v1.4.2 on Wed May 11 11:48:08 2011
*nat
:PREROUTING ACCEPT [13525963:898774555]
:POSTROUTING ACCEPT [9757907:540753704]
:OUTPUT ACCEPT [424486:33294577]
-A PREROUTING -s 192.168.1.0/24 -d 90.181.xxx.xxx -p tcp --dport 80 -j DNAT --to-destination 192.168.1.25:80
-A PREROUTING -d 90.181.xxx.xxx -p tcp -m tcp --dport 25 -j DNAT --to-destination 192.168.1.25:25
-A PREROUTING -d 90.181.xxx.xxx -p tcp -m tcp --dport 143 -j DNAT --to-destination 192.168.1.25:143
-A PREROUTING -p tcp -m tcp -d 90.181.xxx.xxx --dport 80 -j DNAT --to-destination 192.168.1.25
-A PREROUTING -p tcp -m tcp -d 90.181.xxx.xxx --dport 110 -j DNAT --to-destination 192.168.1.25
-A PREROUTING -d 90.181.xxx.xxx -p tcp -m tcp --dport 1194 -j DNAT --to-destination 192.168.1.25:1194
-A PREROUTING -i eth1 -p tcp -m tcp --dport 3389 -j DNAT --to-destination 192.168.1.1
-A PREROUTING -i eth1 -p tcp -m tcp --dport 5555 -j DNAT --to-destination 192.168.1.17
-A PREROUTING -i eth1 -p tcp -m tcp --dport 22016 -j DNAT --to-destination 192.168.1.16:22
-A PREROUTING -i eth1 -p tcp -m tcp --dport 22025 -j DNAT --to-destination 192.168.1.25:22
-A PREROUTING -i eth1 -p tcp -m tcp --dport 33891 -j DNAT --to-destination 192.168.1.17:3389
-A PREROUTING -i eth1 -p tcp -m tcp --dport 9997 -j DNAT --to-destination 192.168.1.17:9997
-A PREROUTING -i eth1 -p tcp -m tcp --dport 9998 -j DNAT --to-destination 192.168.1.17:9998
-A PREROUTING -i eth1 -p udp -m udp --dport 6277 -j DNAT --to-destination 192.168.1.25:6277
-A POSTROUTING -o eth1 -j SNAT --to-source 90.181.xxx.xxx
COMMIT
# Completed on Wed May 11 11:48:08 2011
# Generated by iptables-save v1.4.2 on Wed May 11 11:48:08 2011
*filter
:INPUT DROP [0:0]
:FORWARD DROP [8106:396226]
:OUTPUT ACCEPT [21210267:8584805387]
:dos - [0:0]
:dos_lim - [0:0]
:dos_log - [0:0]
:forward_log - [0:0]
:forward_log_lim - [0:0]
:forward_log_log - [0:0]
:input_log - [0:0]
:input_log_lim - [0:0]
:input_log_log - [0:0]
:limit_p - [0:0]
:limit_p_lim - [0:0]
:limit_p_log - [0:0]
:limit_ssh - [0:0]
:limit_ssh_lim - [0:0]
:limit_ssh_log - [0:0]
:limits - [0:0]
:reject_ip - [0:0]
:rezer_ip - [0:0]
:tracking - [0:0]
:tracking_lim - [0:0]
:tracking_log - [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth0 -j ACCEPT
-A INPUT -i eth1 -j rezer_ip
-A INPUT -i tap0 -j ACCEPT
-A INPUT -j tracking
-A INPUT -j reject_ip
-A INPUT -j dos
-A INPUT -j limits
-A INPUT -p icmp -m icmp ! --icmp-type 5 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 113 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -i eth1 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -i eth1 -p udp -m udp --dport 1194 -j ACCEPT
-A INPUT -i eth1 -p tcp --dport 1194 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --dport 69 -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -s 192.168.1.25 -i eth0 -p udp -m udp --dport 161 -j ACCEPT
-A INPUT -s 192.168.1.25 -i eth0 -p tcp -m tcp --dport 161 -j ACCEPT
-A INPUT -s 77.240.xxx.xxx -i eth1 -p udp -m udp --dport 161 -j ACCEPT
-A INPUT -s 77.240.xxx.xxx -i eth1 -p tcp -m tcp --dport 161 -j ACCEPT
-A INPUT -i tun+ -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -i tun+ -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -j input_log
-A FORWARD -s 192.168.255.201/32 -j DROP
-A FORWARD -i eth1 -o tap0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -j tracking
-A FORWARD -j reject_ip
-A FORWARD -i eth1 -j dos
-A FORWARD -i eth1 -p tcp -m tcp --dport 22 -j ACCEPT
-A FORWARD -i eth1 -p tcp -m tcp --dport 25 -j ACCEPT
-A FORWARD -i eth1 -p tcp -m tcp --dport 80 -j ACCEPT
-A FORWARD -i eth1 -p tcp -m tcp --dport 110 -j ACCEPT
-A FORWARD -i eth1 -p tcp -m tcp --dport 143 -j ACCEPT
-A FORWARD -i eth1 -p tcp -m tcp --dport 3389 -j ACCEPT
-A FORWARD -i eth1 -p tcp -m tcp --dport 33895 -j ACCEPT
-A FORWARD -i eth1 -p tcp -m tcp --dport 5555 -j ACCEPT
-A FORWARD -p tcp -m tcp --dport 9997 -j ACCEPT
-A FORWARD -p tcp -m tcp --dport 9998 -j ACCEPT
-A FORWARD -i eth1 -j rezer_ip
-A FORWARD -i eth0 -o eth0 -j ACCEPT
-A FORWARD -i eth0 -p icmp -j ACCEPT
-A FORWARD -i eth0 -o eth1 -j ACCEPT
-A FORWARD -i eth0 -o tun+ -j ACCEPT
-A FORWARD -i tap0 -j ACCEPT
-A FORWARD -i tun+ -j ACCEPT
-A OUTPUT -j reject_ip
-A dos -m hashlimit --hashlimit-upto 1/sec --hashlimit-burst 100 --hashlimit-mode srcip --hashlimit-name dos --hashlimit-htable-size 64 --hashlimit-htable-max 512 --hashlimit-htable-expire 1200$
-A dos -m hashlimit --hashlimit-upto 2/min --hashlimit-burst 3 --hashlimit-mode srcip --hashlimit-name log_dos --hashlimit-htable-size 16 --hashlimit-htable-max 128 --hashlimit-htable-expire 30$
-A dos -m limit --limit 2/min --limit-burst 1 -j ULOG --ulog-prefix "DoS (limit IP):"
-A dos -j DROP
-A dos_lim -m limit --limit 4/min --limit-burst 10 -j dos_log
-A dos_lim -m limit --limit 4/min --limit-burst 1 -j ULOG --ulog-prefix "DoS (limit TOTAL):"
-A dos_lim -j DROP
-A dos_log -j ULOG --ulog-prefix "DoS:"
-A dos_log -j DROP
-A forward_log -m hashlimit --hashlimit-upto 2/min --hashlimit-burst 3 --hashlimit-mode srcip --hashlimit-name forward_log --hashlimit-htable-size 16 --hashlimit-htable-max 128 --hashlimit-htab$
-A forward_log -m limit --limit 2/min --limit-burst 1 -j ULOG --ulog-prefix "FORWARD (limit IP):"
-A forward_log -j DROP
-A forward_log_lim -m limit --limit 4/min --limit-burst 10 -j forward_log_log
-A forward_log_lim -m limit --limit 4/min --limit-burst 1 -j ULOG --ulog-prefix "FORWARD (limit TOTAL):"
-A forward_log_lim -j DROP
-A forward_log_log -j ULOG --ulog-prefix "FORWARD:"
-A forward_log_log -j DROP
-A input_log -m pkttype --pkt-type broadcast -j DROP
-A input_log -i eth0 -p udp -m udp --dport 137:138 -j DROP
-A input_log -m hashlimit --hashlimit-upto 2/min --hashlimit-burst 3 --hashlimit-mode srcip --hashlimit-name input_log --hashlimit-htable-size 32 --hashlimit-htable-max 256 --hashlimit-htable-e$
-A input_log -m limit --limit 2/min --limit-burst 1 -j ULOG --ulog-prefix "INPUT (limit IP):"
-A input_log -j DROP
-A input_log_lim -m limit --limit 4/min --limit-burst 10 -j input_log_log
-A input_log_lim -m limit --limit 4/min --limit-burst 1 -j ULOG --ulog-prefix "INPUT (limit TOTAL):"
-A input_log_lim -j DROP
-A input_log_log -j ULOG --ulog-prefix "INPUT:"
-A input_log_log -j DROP
-A limit_p -m hashlimit --hashlimit-upto 1/sec --hashlimit-burst 50 --hashlimit-mode srcip,dstport --hashlimit-name limit_p --hashlimit-htable-size 256 --hashlimit-htable-max 2048 --hashlimit-h$
-A limit_p -m hashlimit --hashlimit-upto 2/min --hashlimit-burst 3 --hashlimit-mode srcip --hashlimit-name log_limit_p --hashlimit-htable-size 32 --hashlimit-htable-max 256 --hashlimit-htable-e$
-A limit_p -m limit --limit 2/min --limit-burst 1 -j ULOG --ulog-prefix "Limit port (limit IP):"
-A limit_p -j DROP
-A limit_p_lim -m limit --limit 4/min --limit-burst 10 -j limit_p_log
-A limit_p_lim -m limit --limit 4/min --limit-burst 1 -j ULOG --ulog-prefix "Limit port (limit TOTAL):"
-A limit_p_lim -j DROP
-A limit_p_log -j ULOG --ulog-prefix "Limit port:"
-A limit_p_log -j DROP
-A limit_ssh -s 77.93.xxx.xxx/32 -j RETURN
-A limit_ssh -s 77.93.xxx.xxx/32 -j RETURN
-A limit_ssh -s 89.185.239.105/32 -j RETURN
-A limit_ssh -s 212.24.154.100/32 -j RETURN
-A limit_ssh -m hashlimit --hashlimit-upto 1/min --hashlimit-burst 3 --hashlimit-mode srcip --hashlimit-name limit_ssh --hashlimit-htable-size 8 --hashlimit-htable-max 64 --hashlimit-htable-exp$
-A limit_ssh -m hashlimit --hashlimit-upto 2/min --hashlimit-burst 3 --hashlimit-mode srcip --hashlimit-name log_limit_ssh --hashlimit-htable-size 4 --hashlimit-htable-max 32 --hashlimit-htable$
-A limit_ssh -m limit --limit 2/min --limit-burst 1 -j ULOG --ulog-prefix "Limit SSH (limit IP):"
-A limit_ssh -j DROP
-A limit_ssh_lim -m limit --limit 4/min --limit-burst 10 -j limit_ssh_log
-A limit_ssh_lim -m limit --limit 4/min --limit-burst 1 -j ULOG --ulog-prefix "Limit SSH (limit TOTAL):"
-A limit_ssh_lim -j DROP
-A limit_ssh_log -j ULOG --ulog-prefix "Limit SSH:"
-A limit_ssh_log -j DROP
-A limits -p tcp -m tcp --dport 22 -j limit_ssh
-A limits -p tcp -m tcp --dport 22 -j RETURN
-A limits -j limit_p
-A reject_ip -s 169.254.0.0/16 -j REJECT --reject-with icmp-port-unreachable
-A reject_ip -d 169.254.0.0/16 -j REJECT --reject-with icmp-port-unreachable
-A reject_ip -s 224.0.0.0/4 -j REJECT --reject-with icmp-port-unreachable
-A reject_ip -d 224.0.0.0/4 -j REJECT --reject-with icmp-port-unreachable
-A rezer_ip -s 10.0.0.0/8 -j DROP
-A rezer_ip -s 172.16.0.0/12 -j DROP
-A rezer_ip -s 192.168.0.0/16 -j DROP
-A rezer_ip -d 10.0.0.0/8 -j DROP
-A rezer_ip -d 172.16.0.0/12 -j DROP
-A rezer_ip -d 192.168.0.0/16 -j DROP
-A tracking -p tcp -m state --state NEW -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m hashlimit --hashlimit-upto 2/min --hashlimit-burst 3 --hashlimit-mode srcip --hashlimit-name log_tracking --h$
-A tracking -p tcp -m state --state NEW -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 2/min --limit-burst 1 -j ULOG --ulog-prefix "Tracking (limit IP):"
-A tracking -p tcp -m state --state NEW -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -j DROP
-A tracking -m state --state RELATED,ESTABLISHED -j ACCEPT
-A tracking_lim -m limit --limit 4/min --limit-burst 10 -j tracking_log
-A tracking_lim -m limit --limit 4/min --limit-burst 1 -j ULOG --ulog-prefix "Tracking (limit TOTAL):"
-A tracking_lim -j DROP
-A tracking_log -j ULOG --ulog-prefix "Tracking:"
-A tracking_log -j DROP
COMMIT
# Completed on Wed May 11 11:48:08 2011


[ntz_reloaded]

MX zaznam v dns je to co potrebujes

[Cepela]

A nebude nahodou zaznam v notebooku nacachovanej?

[ntz_reloaded]

to je taky mozne .. me se to stava s nasi domenou v praci, kdyz prechazim mezi ruznejma sitema (eg v praci uspim ntb a kdyz ho doma probudim, tak se to snazi pripojit se na nasi LAN adresu mailserveru misto na WAN)

[Cepela]

Takze asi nejlepsi bude sloucit mailserver a gw do jednoho stroje, jako to mam jinde a tam to beha.... To jsem uplne slyset nechtel.