DNAT and IP aliasing - how?

DNAT and IP aliasing - how?

[Henning Riis Rasmussen]

Hi all

I'm setting up a firewall using kernel 2.4.20 with iptables 1.2.7a (and some
patches).

The firewall has 3 NICS:

  LAN0  (Local protected network)
  WAN1  (Sister organisation)
  INET2 (Internet)

IP adresses used on LAN and WAN are not routable and must therefore all be
translated by the firewall (i.e. WAN can not route the addresses belonging
to LAN).

Generally hosts on the LAN accessing the WAN should be SNAT'ed behind the
WAN1 interface (and this is no problem).

But at the same time some host on the LAN need to provide services to hosts
on the WAN. And there need to be more than one LAN host providing the same
service (i.e. "DNS") with no possibility of moving that service to another
port.

Hence, I need WAN1 to have more than one IP address (i.e. 10.0.0.1/24,
10.0.0.2/24 and 10.0.0.3/24).

I assume I should use DNAT to provide the address translation needed for the
hosts on the LAN that must be visible on the WAN. But what am I supposed to
do about getting arp responses for the extra IP addresses on the WAN1
interface? I recall using the kernel IP aliasing option in previous setups,
but this is no longer an option in kernel 2.4.20 (as far as I can tell).

What is the "correct" way to set this up?

Regards,
Henning

Re: DNAT and IP aliasing - how?

[Joel Newkirk]

On Monday 10 March 2003 06:02 am, Henning Riis Rasmussen wrote:

>   LAN0  (Local protected network)
>   WAN1  (Sister organisation)
>   INET2 (Internet)

> Hence, I need WAN1 to have more than one IP address (i.e. 10.0.0.1/24,
> 10.0.0.2/24 and 10.0.0.3/24).
>
> I assume I should use DNAT to provide the address translation needed
> for the hosts on the LAN that must be visible on the WAN. But what am
> I supposed to do about getting arp responses for the extra IP
> addresses on the WAN1 interface? I recall using the kernel IP aliasing
> option in previous setups, but this is no longer an option in kernel
> 2.4.20 (as far as I can tell).
>
> What is the "correct" way to set this up?

if WAN1 is eth0 with 10.0.0.1 presently, then try this:

ifconfig eth0:1 10.0.0.2 netmask 255.255.255.0
ifconfig eth0:2 10.0.0.3 netmask 255.255.255.0

This creates an alias on eth0 adding 10.0.0.2 as an additional IP for 
that interface, then again for 10.0.0.3.  Obviously the root interface 
needs to match the WAN interface.  A subsequent 'ifconfig' will show 
these as additional interfaces on the same MAC.  Packet info (RX and TX 
statistics) will show only on the root interface.  In an iptables rule 
you can only use the root interface (eth0 in the above example) but can 
still match source or dest IP to distinguish one from another in most 
cases.

j

RE: DNAT and IP aliasing - how?

[Elmshauser, Erik]

> -----Original Message-----
> From: Joel Newkirk [mailto:netfilter@newkirk.us]
> Sent: Tuesday, March 11, 2003 6:10 AM
> Subject: Re: DNAT and IP aliasing - how?
> 
> On Monday 10 March 2003 06:02 am, Henning Riis Rasmussen wrote:
> >
> > What is the "correct" way to set this up?
> 
> if WAN1 is eth0 with 10.0.0.1 presently, then try this:
> 
> ifconfig eth0:1 10.0.0.2 netmask 255.255.255.0
> ifconfig eth0:2 10.0.0.3 netmask 255.255.255.0
> 
> This creates an alias on eth0 adding 10.0.0.2 as an additional IP for
> that interface, then again for 10.0.0.3
>

I thought that this method was deprecated as of the 2.2.x kernel and the
new iproute2 tools?  Isn't the "correct" method actually:

# add address 10.0.0.2/24 (i.e. standard netmask and broadcast) to eth0
ip addr add 10.0.0.2/24 brd + dev eth0

# add address 10.0.0.3/24 (i.e. standard netmask and broadcast) to eth0
ip addr add 10.0.0.3/24 brd + dev eth0

I think the command reference that comes with it is great, and it's on
the web too: http://snafu.freedom.org/linux2.2/docs/ip-cref/

This is a pretty good rundown on how it works:
http://snafu.freedom.org/linux2.2/iproute-notes.html

The tools are located here: ftp://ftp.inr.ac.ru/ip-routing/

	--Erik

Rev. Dr. Erik C Elmshauser D.D.
Head of I.T.
Pacific Benefits Group NW LLC
erike@pbgnw.com
Phone  - 800.259.0455
Fax    - 800.662.0082
 There are 10 kinds of people in the world,
Those that can do binary arithmetic, and those that can't.