HI,

here I have an eMail with connected to a DMZ 10.0.0.0/24 network. This server holds 10.0.0.87

There are two firewall-hosts one with CentOS 6 10.0.0.10 and one with CentOS 7 10.0.0.17

The CentOS 6 has the following iptables-rule (extract):
———————-8<----------------------8<----------------------8< *nat -A POSTROUTING -o eth1 -j MASQUERADE -A PREROUTING -i eth1 -d 217.91.103.190/32 -p tcp -m tcp --dport 25 -j DNAT --to-destination 10.0.0.87:25 *filter -A FORWARD -d 10.0.0.87/32 -i ppp0 -o eth0 -p tcp -m state –state NEW -m tcp –dport 25 -j ACCEPT ———————-8<----------------------8<----------------------8< If a external mailserver access the firewall, the traffic is routed to 10.0.0.87 port 25. As IP-adress from the external server I see hois public-IP. Here’s the part of maillog: Jan 26 13:03:20 vml000087 postfix/postscreen[14214]: CONNECT from [88.198.212.215]:36131 to [10.0.0.87]:25 Jan 26 13:03:20 vml000087 postfix/postscreen[14214]: PASS OLD [88.198.212.215]:36131 Jan 26 13:03:20 vml000087 postfix/smtpd[10268]: connect from mx1.piratenpartei-bayern.de[88.198.212.215] Jan 26 13:03:31 vml000087 postfix/smtpd[10268]: disconnect from mx1.piratenpartei-bayern.de[88.198.212.215] so far so good, this work’ed fine the last 5 years … Now I’ve a second network with a CentOS 7 base firewall. I’ve tried to adapt the roules I’ve mad on the old firewall.

———————-8<----------------------8<----------------------8< # cat /etc/firewalld/zones/public.xml

Public
For use on external networks. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.

# cat /etc/firewalld/zones/private.xml


Private
For use on internal networks. You mostly trust the other computers on the networks to not harm your computer. Only selected incoming connections are accepted.

# cat /etc/firewalld/direct.xml


-o eth1
-j MASQUERADE
-i eth1
-d 192.168.0.17/32 -p tcp -m tcp –dport 25 -j DNAT –to-destination
10.0.0.87:25
-i eth1
-d 10.0.0.87/32 -p tcp -m state –state NEW -m tcp –dport 25 -j ACCEPT

———————-8<----------------------8<----------------------8< The traffic over this firewall is routed to my mailserver, too. BUT I did’nt see the external customer-IP, I only can see the IP-address of my own firewall. Jan 26 13:04:52 vml000087 postfix/postscreen[14214]: CONNECT from [10.0.0.17]:33803 to [10.0.0.87]:25 Jan 26 13:04:52 vml000087 postfix/postscreen[14214]: WHITELISTED [10.0.0.17]:33803 Jan 26 13:04:52 vml000087 postfix/smtpd[10268]: connect from vml000017.dmz.nausch.org[10.0.0.17] Jan 26 13:04:53 vml000087 postfix/smtpd[11397]: disconnect from vml000017.dmz.nausch.org[10.0.0.17] So I think destination NAT (DNAT) isn’t working on my CentOS 7 host. As I seaid on my CentOS6 host DNAT is working very well.

So where’s my error? in my configuration or in my head? ;)

Thanx 4 help!

ttyl Django