Using ASL V5.012 - I understand that making changes to the Astaro scripts or OS are not supported, but I can't find any other way of doing this. Basically I need to configure a "no nat" rule.

My network looks like this:


Internal - E0 (168.182.202.32/29) -- ASTARO FW -- (168.182.202.40/27) E1 - dmz
|
|
(206.9.139.239) External - ppp0


I only want to NAT traffic going from the Internal network (e0) to the Internet (ppp0). Traffic from the Internal network to the dmz must not be nat'd. I can't find a way to do this from Webadmin (as you can't specify the outbound interface - ppp0). The only way I could resolve this, was by adding the following command on the cli:

/usr/sbin/iptables -t nat -A POSTROUTING -s 168.182.202.32/29 -o ppp0 -j SNAT --to 206.9.139.239

Is there a startup script where I could add this line, so it is retained after a reboot and doesn't get deleted by Middleware ?

Thanks for your help

No big deal - [Network] - [NAT/MAsquerading] you only have to add an new "Masquerading" rule with Network=dmz and Interface=ppp0 - that´s it!

This does NOT imply that traffic from the dmz to the internal network is "masqueraded" as well...

techno.kid

Thanks tk for that tip. Unfortunately I've already tried that option with little sucess. To be honest my astaro configuration is not as simple as depicted in the diagram - I use several vlans and secondary addresses and require more granularity on what protocols should be nat'd. When I attempted Masquerding, I had several conflicts and had more luck with SNAT.

Thanks anyway.

As techno kid (not Cisco kid?) rightly points out, it is always preferable to try and make it work from GUI for reasons of ongoing support. But if you have to, Search for iptables.local...