Есть сеть - шлюз ASP Linux. Одним концом смотрит в локалку ip-192.168.1.10 другим на прова, причем через тунель ip-ip tun1-222.222.222.222 через который имеем SNAT для локалки, DNS прова 222.222.222.1 . Задача доступ к внутреннему терминал серверу с ip-192.168.1.254 не работает тем методом который я "наваял"... Я к сожалению не силен :-( в iptables. Подскажите что не так?

Вот содержание файла iptables

# Generated by iptables-save v1.2.7a on Mon Jul 14 13:32:08 2003
*nat
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A PREROUTING -p tcp -m tcp -d 222.222.222.222 --dport 3389 -j DNAT --to-destination 192.168.1.254:3389
-A POSTROUTING -o tun0 -j SNAT --to-source 222.222.222.222
-A PREROUTING -p tcp -m tcp ! -d 192.168.1.0 -i eth0 --dport 80 -j REDIRECT --to-ports 3128
COMMIT
# Completed on Mon Jul 14 13:32:08 2003
# Generated by iptables-save v1.2.7a on Mon Jul 14 13:32:08 2003
*mangle
:PREROUTING ACCEPT [98:6723]
:INPUT ACCEPT [68:4712]
:FORWARD ACCEPT [14:608]
:OUTPUT ACCEPT [18:504]
:POSTROUTING ACCEPT [32:1112]
COMMIT
# Completed on Mon Jul 14 13:32:08 2003
# Generated by iptables-save v1.2.7a on Mon Jul 14 13:32:08 2003
*filter
:INPUT DROP [0:0]
:tcp_packets - [0:0]
:OUTPUT DROP [0:0]
:allow_all - [0:0]
:FORWARD DROP [0:0]
:allowed - [0:0]
:RH-Lokkit-0-50-INPUT - [0:0]
:icmp_packets - [0:0]
:udp_packets - [0:0]
:bad_tcp_packets - [0:0]
-A INPUT -j RH-Lokkit-0-50-INPUT
-A INPUT -p tcp -j bad_tcp_packets
-A INPUT -s 222.222.222.222 -i tun0 -j ACCEPT
-A INPUT -i tun0 -j ACCEPT
-A INPUT -s 192.168.1.0/255.255.255.0 -i eth0 -j ACCEPT
-A INPUT -s 127.0.0.1 -i lo -j ACCEPT
-A INPUT -s 192.168.1.10 -i lo -j ACCEPT
-A INPUT -s 192.168.244.3 -i lo -j ACCEPT
-A INPUT -d 192.168.1.255 -i eth0 -j ACCEPT
-A INPUT -p udp -m udp -i eth0 --dport 67 --sport 68 -j ACCEPT
-A INPUT -m state -d 192.168.244.3 --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -m state -d 222.222.222.222 --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p tcp -i eth1 -j tcp_packets
-A INPUT -p tcp -m tcp -i tun0 -j tcp_packets
-A INPUT -p udp -i eth1 -j udp_packets
-A INPUT -p udp -m udp -i tun0 -j udp_packets
-A INPUT -p icmp -i eth1 -j icmp_packets
-A INPUT -p icmp -i tun0 -j icmp_packets
-A FORWARD -j RH-Lokkit-0-50-INPUT
-A FORWARD -p tcp -j bad_tcp_packets
-A FORWARD -o tun0 -j ACCEPT
-A FORWARD -i tun0 -j ACCEPT
-A FORWARD -i eth0 -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -m limit --limit 3/min --limit-burst 3 -j LOG  --log-prefix "IPT FORWARD packet died: " --log-level debug
-A OUTPUT -p tcp -j bad_tcp_packets
-A OUTPUT -s 222.222.222.222 -j ACCEPT
-A OUTPUT -s 127.0.0.1 -j ACCEPT
-A OUTPUT -s 192.168.1.10 -j ACCEPT
-A OUTPUT -s 192.168.244.3 -j ACCEPT
-A OUTPUT -m limit --limit 3/min --limit-burst 3 -j LOG  --log-prefix "IPT OUTPUT packet died: " --log-level debug
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 22 --tcp-flags SYN,RST,ACK SYN -j ACCEPT
-A RH-Lokkit-0-50-INPUT -i lo -j ACCEPT
-A RH-Lokkit-0-50-INPUT -i eth0 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p udp -m udp -s 192.168.244.1 --sport 53 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p udp -m udp -s 222.222.222.1 --sport 53 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p udp -m udp -s 192.168.244.1 --sport 53 -j ACCEPT
-A RH-Lokkit-0-50-INPUT -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j REJECT  --reject-with icmp-port-unreachable
-A RH-Lokkit-0-50-INPUT -p udp -m udp -j REJECT  --reject-with icmp-port-unreachable
-A allowed -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j ACCEPT
-A allowed -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT
-A allowed -p tcp -j DROP
-A bad_tcp_packets -p tcp -m tcp -m state ! --tcp-flags SYN,RST,ACK SYN --state NEW -j LOG  --log-prefix "New not syn:"
-A bad_tcp_packets -p tcp -m tcp -m state ! --tcp-flags SYN,RST,ACK SYN --state NEW -j DROP
-A icmp_packets -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A icmp_packets -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A tcp_packets -p tcp -m tcp --dport 21 -j allowed
-A tcp_packets -p tcp -m tcp --dport 22 -j allowed
-A tcp_packets -p tcp -m tcp --dport 80 -j allowed
-A tcp_packets -p tcp -m tcp --dport 113 -j allowed
-A udp_packets -p udp -m udp --dport 2074 -j ACCEPT
-A udp_packets -p udp -m udp --dport 4000 -j ACCEPT
-A INPUT -m limit --limit 3/min --limit-burst 3 -j LOG  --log-prefix "IPT INPUT packet died: " --log-level debug
-A allow_all -p tcp -m tcp -j ACCEPT
-A allow_all -p ip -j ACCEPT
-A allow_all -j ACCEPT
COMMIT
# Completed on Mon Jul 14 13:32:08 2003

• iptables-помогите найти ошибку!, Roman, 14:13 , 12-Ноя-04, (1)