little question about output dnat

little question about output dnat

[Giacomo]

Just a little doubt originated by two contrasting documents on the web...

IF i put an OUTPUT DNAT rule, i.e. i redirect the web traffic to port 80
to the address of the proxy:8080,
the FILTER rules are applied to the original address:port and not to the
DNATTED address, right?
Or are they applied both before and after the DNAT translation?

Thanks Giacomo

-- 
Giacomo S.
http://www.giacomos.it

- - - - - - - - - - - - - - - - - - - - - -

IPFIREwall (http://www.giacomos.it/ipfire) viene presentato
all'Universita` degli Studi di Udine, il 28 ottobre, in occasione del
Linux Day 2006:
http://iglu.cc.uniud.it/linuxday

- - - - - - - - - - - - - - - - - - - - - -

 . ''  `.
:   :'    :
 `.  ` '
    `- Debian GNU/Linux -- The power of freedom
        http://www.debian.org

Re: little question about output dnat

[Jan Engelhardt]

On Feb 19 2007 10:49, Giacomo wrote:

> Just a little doubt originated by two contrasting documents on the web...
>
> IF i put an OUTPUT DNAT rule, i.e. i redirect the web traffic to port 80
> to the address of the proxy:8080,
> the FILTER rules are applied to the original address:port and not to the
> DNATTED address, right?
> Or are they applied both before and after the DNAT translation?

See http://imagestream.com/~josh/PacketFlow-new.png