hjaelp til iptables

Jeg skal ha redirectet(maaske?) trafikken i min firewall så alt trafik fra subnet 192.168.223.0/24 paa port 80 der forsoeger at komme ud bliver sendt til 192.168.223.1:80(firewallen selv)

Giver det mening?

Jeg har været ude i at prøve noget med:
iptables -t nat -A INPUT -s 192.168.223.0/24 -p tcp --dport 80 -j REDIRECT --to-destination 192.168.223.1:80

Er det korrekt? jeg tænker lidt at den bare vil loope og til sidst droppe pakken?


Nogen der har et løsnings forslag?

Her er en liste over mine interfaces og nuværende iptables.

wireless:/# ifconfig
eth0      Link encap:Ethernet  HWaddr 00:c0:9f:09:d2:c2
          inet addr:130.226.217.203  Bcast:130.226.217.223  Mask:255.255.255.224
          inet6 addr: fe80::2c0:9fff:fe09:d2c2/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:592114658 errors:0 dropped:0 overruns:0 frame:0
          TX packets:830280341 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:2421290898 (2.2 GiB)  TX bytes:2961439949 (2.7 GiB)

eth1      Link encap:Ethernet  HWaddr 00:02:b3:da:78:e8
          inet addr:192.168.223.1  Bcast:192.168.223.255  Mask:255.255.255.0
          inet6 addr: fe80::202:b3ff:feda:78e8/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:825673034 errors:1036 dropped:0 overruns:0 frame:1036
          TX packets:585979957 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:3152120804 (2.9 GiB)  TX bytes:4286640463 (3.9 GiB)

eth1:2    Link encap:Ethernet  HWaddr 00:02:b3:da:78:e8
          inet addr:192.168.224.1  Bcast:192.168.224.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

eth2      Link encap:Ethernet  HWaddr 00:08:c7:19:4a:b6
          inet addr:192.168.1.50  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::208:c7ff:fe19:4ab6/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:367741 errors:0 dropped:0 overruns:0 frame:0
          TX packets:10735 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:22135675 (21.1 MiB)  TX bytes:608806 (594.5 KiB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:111587 errors:0 dropped:0 overruns:0 frame:0
          TX packets:111587 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:23063345 (21.9 MiB)  TX bytes:23063345 (21.9 MiB)


wireless:/etc/dhcp3# cat iptables.conf
#!/bin/sh

iptables -t nat -F
iptables -F

iptables -t nat -A POSTROUTING -s 192.168.224.0/22 -j SNAT --to 130.226.217.203

iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A FORWARD -m mac --mac-source 00:11:f5:4b:21:35 -s 192.168.224.10 -j ACCEPT
iptables -A FORWARD -m mac --mac-source 00:1d:4f:f9:6d:3b -s 192.168.224.11 -j ACCEPT
iptables -A FORWARD -m mac --mac-source 00:0d:93:eb:a4:e0 -s 192.168.224.12 -j ACCEPT
iptables -A FORWARD -m mac --mac-source 00:24:d2:b5:42:46 -s 192.168.224.13 -j ACCEPT
iptables -A FORWARD -m mac --mac-source 00:13:e8:70:62:9d -s 192.168.224.14 -j ACCEPT
iptables -A FORWARD -m mac --mac-source 00:22:43:15:43:e1 -s 192.168.224.15 -j ACCEPT
iptables -A FORWARD -m mac --mac-source 00:1b:63:02:dc:16 -s 192.168.224.16 -j ACCEPT
iptables -A FORWARD -m mac --mac-source 00:0e:35:36:27:d1 -s 192.168.224.17 -j ACCEPT
iptables -A FORWARD -m mac --mac-source 00:26:b0:b4:62:f3 -s 192.168.224.18 -j ACCEPT
iptables -A FORWARD -m mac --mac-source 00:1e:c2:c0:de:24 -s 192.168.224.76 -j ACCEPT
iptables -A FORWARD -m mac --mac-source 00:16:e3:a0:c0:bb -s 192.168.224.9 -j ACCEPT

iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i eth0 -j ACCEPT

iptables -A INPUT -s 192.168.223.0/24 -p tcp --dport 53 -j ACCEPT
iptables -A INPUT -s 192.168.223.0/24 -p udp --dport 53 -j ACCEPT
iptables -A INPUT -s 192.168.223.0/24 -p udp --dport 67:68 --sport 67:68 -j ACCEPT
iptables -A INPUT -s 192.168.223.0/24 -p tcp --dport 80 -j ACCEPT

iptables -A INPUT -s 192.168.224.0/22 -p udp --dport 67:68 --sport 67:68 -j ACCEPT
iptables -A INPUT -s 192.168.224.0/22 -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -s 192.168.224.0/22 -p tcp --dport 22 -j ACCEPT

iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
iptables -P INPUT DROP