http://forum.openwrt.org/viewtopic.php?id=4030

iptables -t nat -A prerouting_rule -d x.x.x.x -p tcp --dport 80 -j DNAT --to 10.0.0.2
iptables -A forwarding_rule -p tcp --dport 80 -d 10.0.0.2 -j ACCEPT
iptables -t nat -A postrouting_rule -s 10.0.0.0/24 -p tcp --dport 80 -d 10.0.0.2 -j MASQUERADE

iptables -t nat -A POSTROUTING -p tcp –dst $HTTPIP –dport 80 -j SNAT –to-source $LANIP

iptables -t nat -A OUTPUT –dst $INETIP -p tcp –dport 80 -j DNAT –to-destination $HTTPIP

Check http://iptables-tutorial.frozentux.net/chunkyhtml/x4013.html for explanations of the lines above. Another good reference is http://tldp.org/HOWTO/IP-Masquerade-HOWTO/index.html (and http://www.openbsd.org/faq/pf/rdr.html if you are on BSD). The DNS solution seems better since it won’t harm your logging.

I believe what you are looking for is something like the following two rules:

1.) $IPTABLES -A FORWARD -i $EXTIF -o $INTIF -p tcp –dport 80 -m state –state NEW,ESTABLISHED,RELATED -j ACCEPT

2.) $IPTABLES -A FORWARD -i $EXTIF -o $INTIF -p tcp –dport 80 -m state –state NEW,ESTABLISHED,RELATED -j ACCEPT

I hope that helps!

Heretic

address=/foo.dyndns.org/192.168.123.123

Still feeling like a moron.

Bah, I’ll probably just end up going back to a DNS cache.

You also stated you access it via your “external IP” - are you not using a dynamic DNS service like DynDNS to give your home an external domain? You could even then use a real DNS provider to make a nicer domain (say a subdomain of your website) be a CNAME pointing at the DynDNS entry. m0n0wall and many other routers also have DynDNS clients built in. Who needs static IPs? You certainly don’t if all you need is web and ssh access.

So for example, I may have an internal web server running at 192.168.1.10, with my external IP being 1.2.3.4. So I have home.cafgood.com as a CNAME pointing at cafgood.dyndns.com which gets automatically set to resolve to my external home IP (1.2.3.4). On my router, I then say home.cafgood.com equals the internal IP (192.168.1.10). From the outside, I would hit real DNS servers, get CNAME-pointed to DynDNS servers, which would point me at my external IP, and NAT points at the web server. From the inside, the overridden DNS forwarder would just point any internal request right at the web server.

Stuart: I did just that at one point, by running a DNS proxy on the home LAN that gave an internal IP answer for the equivalent of home.decafbad.com - while the rest of the world saw the WAN address. I think I did it with tinydns, but I seem to remember it was a pain in the butt for some reason. I should check it out again.