Editing Linux router with WAN, LAN and DMZ (section)

=== Publish the DMZ servers (DNAT) ===
<code>25</code> is plain SMTP with STARTTLS, <code>587</code> is the submission
port (also STARTTLS) and <code>465</code> is implicit TLS submission. Drop
whichever of the two submission ports your mail server does not offer.

<syntaxhighlight lang="bash">
# Mail -> 10.0.0.10
iptables -t nat -A PREROUTING -i eth0 -p tcp -m multiport \
         --dports 25,465,587,993 -j DNAT --to-destination 10.0.0.10

# Web -> 10.0.0.20
iptables -t nat -A PREROUTING -i eth0 -p tcp -m multiport \
         --dports 80,443 -j DNAT --to-destination 10.0.0.20
</syntaxhighlight>

DNAT only rewrites the destination. The packet still has to survive
<code>FORWARD</code>, which is where the matching accepts belong:

<syntaxhighlight lang="bash">
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m conntrack --ctstate INVALID -j DROP

iptables -A FORWARD -i eth0 -o eth2 -d 10.0.0.10 -p tcp -m multiport \
         --dports 25,465,587,993 -j ACCEPT
iptables -A FORWARD -i eth0 -o eth2 -d 10.0.0.20 -p tcp -m multiport \
         --dports 80,443 -j ACCEPT
</syntaxhighlight>