From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Ryan Beisner" Subject: re: WAP11 through router Date: Wed, 18 Sep 2002 16:31:45 -0500 Sender: netfilter-admin@lists.netfilter.org Message-ID: <0d3901c25f5a$c9de9c60$64dc0a0a@dataarc> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0D36_01C25F30.E0E88940" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter@lists.netfilter.org This is a multi-part message in MIME format. ------=_NextPart_000_0D36_01C25F30.E0E88940 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable How about this: Ext IF eth1 IP 10.20.0.3 (insignificant unnecessary info for this = config) Ext IF eth1:1 Virtual IP 10.20.0.4 Int IF eth0 IP 192.168.168.1 =20 I want a one-to-one bidirectional NAT map from 10.20.0.4 to = 192.168.168.178 for all ports. I will explicitly allow and deny = protocols later. Again, this is already behind a firewall in my = corporation. The goal is to make 10.20.0.4 a full "representative" of = my WAP11. Security is taken care of elsewhere with the firebox. =3D = ) Using IPTRAF, I can see the request coming through, but the answer = doesn't make it out. I'm just not figuring that out. Thanks again, I = really appreciate any help you can provide. -Ryan Beisner On Wednesday 18 September 2002 9:44 pm, Ryan Beisner wrote: > Hi All! > > I have a Linksys WAP11 behind a high speed connection. > > Here's the scenario: > > INT (eth0) IP Range ( 192.168.168.1 class C ) > EXT (eth1) IP Range also private ( 10.20.0.3 class B ) > EXT (eth1:1) Virtual IP is 10.20.0.4 > > I want to map everything from Virt IP (Eth1:1) 10.20.0.4 (all ports) = to > internal 192.168.168.178 (the Linksys WAP 11). FYI this is for remote > management of my access point. > > Here was my first attempt, which did not work. I explicitly allow all > traffic in/out/fwd for 10.20.0.4 to make sure I wasn't kicking myself = here. > Still no go. Suggestions? > > ""iptables -A PREROUTING -t nat -d 10.20.0.4 -j DNAT --to > 192.168.168.178"" The PREROUTING rule looks good. However, remember that by the time packets reach the FORWARD chain, the=20 PREROUTING rule has already NATted them, so you need to allow packets = for=20 192.168.168.178 through netfilter, not packets for 10.20.0.4..... Also, you say you want to do this for "remote management of the access=20 point", so why do you want to map *all* ports ? Surely there's only a = very=20 few ways of managing the AP: telnet, snmp, http - any others ? Antony. --=20 If at first you don't succeed, destroy all the evidence that you tried. ------=_NextPart_000_0D36_01C25F30.E0E88940 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

How about this:

Ext IF eth1 IP = 10.20.0.3=20 (insignificant unnecessary info for this = config)

Ext IF eth1:1 = Virtual IP=20 10.20.0.4

Int IF eth0 IP=20 192.168.168.1

I want a one-to-one bidirectional NAT = map from=20 10.20.0.4 to 192.168.168.178 for all ports. I will explicitly = allow and=20 deny protocols later. Again, this is already behind a firewall in = my=20 corporation. The goal is to make 10.20.0.4 a full "representative" = of my=20 WAP11. Security is taken care of elsewhere with the=20 firebox. =3D )

Using IPTRAF, I can see the request = coming through,=20 but the answer doesn't make it out. I'm just not figuring that = out. =20 Thanks again, I really appreciate any help you can provide.

-Ryan Beisner

On Wednesday 18 September 2002 9:44 pm, = Ryan=20 Beisner wrote:

> Hi All!
>
> I = have a=20 Linksys WAP11 behind a high speed = connection.
>
>=20 Here's the = scenario:
>
>     INT=20 (eth0) IP Range ( 192.168.168.1 class C = )
>    =20 EXT (eth1) IP Range also private ( 10.20.0.3 class B=20 )
>     EXT (eth1:1) Virtual IP is=20 10.20.0.4
>
> I want to map everything from = Virt IP=20 (Eth1:1) 10.20.0.4 (all ports) to
> internal = 192.168.168.178 (the=20 Linksys WAP 11). FYI this is for remote
> management = of my=20 access point.
>
> Here was my first attempt, = which did=20 not work. I explicitly allow all
> traffic in/out/fwd = for=20 10.20.0.4 to make sure I wasn't kicking myself = here.
> Still=20 no go. = Suggestions?
>
>    =20 ""iptables -A PREROUTING -t nat -d 10.20.0.4 -j DNAT --to
> = 192.168.168.178""

The PREROUTING rule looks = good.

However,=20 remember that by the time packets reach the FORWARD chain, the =
PREROUTING=20 rule has already NATted them, so you need to allow packets for=20
192.168.168.178 through netfilter, not packets for=20 10.20.0.4.....

Also, you say you want to do this for "remote = management=20 of the access
point", so why do you want to map *all* ports = ?  =20 Surely there's only a very
few ways of managing the AP: telnet, = snmp, http -=20 any others ?

Antony.

--

If at first you don't = succeed,=20 destroy all the evidence that you tried.

------=_NextPart_000_0D36_01C25F30.E0E88940--