From 3c4336da588a18f7325f740c25c41299057cb8c8 Mon Sep 17 00:00:00 2001
From: Tom Eastep <teastep@shorewall.net>
Date: Fri, 7 Jan 2011 10:27:35 -0800
Subject: [PATCH] Enhance DNAT documentation again

---
 docs/FAQ.xml             |  9 ++++++++-
 docs/three-interface.xml | 12 ++++++++++--
 docs/two-interface.xml   |  9 ++++++++-
 3 files changed, 26 insertions(+), 4 deletions(-)

diff --git a/docs/FAQ.xml b/docs/FAQ.xml
index 12d8f3efe..c1793220a 100644
--- a/docs/FAQ.xml
+++ b/docs/FAQ.xml
@@ -223,7 +223,8 @@
       it.</title>
 
       <para><emphasis role="bold">Answer:</emphasis> The format of a
-      port-forwarding rule to a local system is as follows:</para>
+      port-forwarding rule <emphasis>from the net</emphasis> to a local system
+      is as follows:</para>
 
       <programlisting>#ACTION    SOURCE      DEST                                   PROTO        DEST PORT
 DNAT       net         loc:<emphasis>local-IP-address</emphasis>[:<emphasis>local-port</emphasis>]      <emphasis>protocol</emphasis>     <emphasis>port-number</emphasis></programlisting>
@@ -253,6 +254,12 @@ DNAT    net:<emphasis>address</emphasis>   loc:<emphasis>local-IP-address</empha
       column specify the range as
       <emphasis>low-port:high-port</emphasis>.</para>
 
+      <important>
+        <para><emphasis role="bold">The above does not work for forwarding
+        from the local network. If you want to do that, see <link
+        linkend="faq2">FAQ 2</link>.</emphasis></para>
+      </important>
+
       <section id="faq1a">
         <title>(FAQ 1a) Okay -- I followed those instructions but it doesn't
         work</title>
diff --git a/docs/three-interface.xml b/docs/three-interface.xml
index 416bf8430..9b07a6630 100644
--- a/docs/three-interface.xml
+++ b/docs/three-interface.xml
@@ -829,7 +829,15 @@ Web(ACCEPT)  loc    dmz:10.10.11.2</programlisting><itemizedlist>
           <listitem>
             <para>When you are connecting to your server from your local
             systems, you must use the server's internal IP address
-            (<systemitem class="ipaddress">10.10.11.2</systemitem>).</para>
+            (<systemitem class="ipaddress">10.10.11.2</systemitem>) or you
+            must use DNAT from the loc zone as well (see below).</para>
+
+            <programlisting>#ACTION     SOURCE    DEST                PROTO      DEST          SOURCE           ORIGINAL
+#                                                    PORT(S)       PORT(S)          DEST
+Web(DNAT)   loc       dmz:10.10.11.2      -          -             -                <replaceable>external-ip-address</replaceable></programlisting>
+
+            <para>where <replaceable>external-ip-address</replaceable> is the
+            IP address of the firewall's external interface.</para>
           </listitem>
 
           <listitem>
@@ -839,7 +847,7 @@ Web(ACCEPT)  loc    dmz:10.10.11.2</programlisting><itemizedlist>
             <literal>http://w.x.y.z:5000 where w.x.y.z</literal> is your
             external IP).<programlisting>#ACTION   SOURCE    DEST                PROTO      DEST PORT(S)    SOURCE
 #                                                                  PORT(S)
-DNAT      net       dmz:10.10.11.2:80   tcp        80              5000</programlisting></para>
+DNAT      net       dmz:10.10.11.2:80   tcp        5000</programlisting></para>
           </listitem>
 
           <listitem>
diff --git a/docs/two-interface.xml b/docs/two-interface.xml
index 5c33da7dc..39c9e4c85 100644
--- a/docs/two-interface.xml
+++ b/docs/two-interface.xml
@@ -752,10 +752,17 @@ root@lists:~# </programlisting>
     class="directory">/etc/shorewall/</filename><filename>rules</filename>
     file.</para>
 
-    <para>The general form of a simple port forwarding rule in <filename
+    <para>For forwarding connections from the <emphasis>net</emphasis> zone to
+    a server in the <emphasis>loc</emphasis> zone, the general form of a
+    simple port forwarding rule in <filename
     class="directory">/etc/shorewall/</filename><filename>rules</filename> is:
     <programlisting>#ACTION   SOURCE    DEST                                          PROTO      DEST PORT(S)
 DNAT      net       loc:<emphasis>&lt;server local ip address&gt;</emphasis>[:<emphasis>&lt;server port&gt;</emphasis>] <emphasis>&lt;protocol&gt;</emphasis> <emphasis>&lt;port&gt;</emphasis></programlisting><important>
+        <para><emphasis role="bold">If you want to forward traffic from the
+        <emphasis>loc</emphasis> zone to a server in the
+        <emphasis>loc</emphasis> zone, see <ulink url="FAQ.htm#faq2">Shorewall
+        FAQ 2</ulink>.</emphasis></para>
+      </important><important>
         <para>Be sure to add your rules after the line that reads <emphasis
         role="bold">SECTION NEW.</emphasis></para>
       </important><important>