[Firehol-support] DNAT not working where inface and outface are the same

[Carlos Rodrigues]

Hi!

I have a firewall connected to several LANs with NAT, and I need to have
some machines on one of the the LANs accessible from the outside. For
that I set up some interface aliases with public addresses and some DNAT
rules (without an explicit "inface") redirecting those addresses to the
internal machines (along with some accept rules in the proper "router"
blocks).

This works fine when on tries to connect to those public addresses from
the outside, or from one of the other LANs, but doesn't work when the
connection comes from the LAN where the target of the DNAT is (let's
say, users using a fully qualified DNS name that is associated with the
public address, instead of the internal name).

In other words, the DNAT works when the in and out interfaces are
different, but doesn't work when they are the same.

What can be done to work around this problem?

I've even tried to set up a "router" block where the inface and outface
are the same, but that doesn't seem to do a thing...

Thanks...

Carlos Rodrigues