Played around a LOT with iptables, crash course and all that.
I have something that is working, curious if anyone can poke holes in it.
Here is what I add ( this is added after ipmasq starts ):
iptables -t nat -I PREROUTING -i ppp0 -j DNAT -d $EXT --to $INT
iptables -t nat -I POSTROUTING -j SNAT -s $INT --to $EXT
iptables -I FORWARD -d $INT -j ACCEPT
And that seems to give me the behavior I want, namely anything from the $INT IP gets to the external world as coming from the $EXT IP, and hits to the $EXT IP show up on the $INT IP address.
I tested both with ping from work, and shields up.
I understand its as if the $INT IP is right on the internet at the $EXT IP Address, and have the machine locked down ( I hope
) to allow that.
Will this mess anyting else up? I'm thinking I ought to constrain the second iptables command to -o ppp0, so machine to machine doesn't go weird. Also, why do I forward the INT, not the EXT? ( That's what worked ). Does that take place before ( PREROUTING ) the forward?
( I think I just lucked out, I just started messing with iptables in ways that looked right, and got to this
Any and all comments/criticisms welcome.