multiple mapping

multiple mapping

[Tomek Macioszek]

Hi
I have my FIREWALL BOX with address 4.3.2.1 (eth0) and local address 192.168.10.0/24.
Now I have SNAT:
iptables -t nat -A POSTROUTING -s 192.168.10.0/24 -o eth1 -j SNAT --to 4.3.2.1
I would like to make SNAT with i.e two external address.
iptables -t nat -A POSTROUTING -s 192.168.10.0/28 -o eth1 -j SNAT --to 4.3.2.1
iptables -t nat -A POSTROUTING -s 192.168.10.128/28 -o eth1 -j SNAT --to 4.3.2.2. It is good solution? Should I make alias for eth0 with address 4.3.2.2?
Thanks for help and sorry for my English.
Best regards
T.

Re: multiple mapping

[John A. Sullivan III]

On Wed, 2004-09-01 at 03:59, Tomek Macioszek wrote:
> Hi
> I have my FIREWALL BOX with address 4.3.2.1 (eth0) and local address 192.168.10.0/24.
> Now I have SNAT:
> iptables -t nat -A POSTROUTING -s 192.168.10.0/24 -o eth1 -j SNAT --to 4.3.2.1
> I would like to make SNAT with i.e two external address.
> iptables -t nat -A POSTROUTING -s 192.168.10.0/28 -o eth1 -j SNAT --to 4.3.2.1
> iptables -t nat -A POSTROUTING -s 192.168.10.128/28 -o eth1 -j SNAT --to 4.3.2.2. It is good solution? Should I make alias for eth0 with address 4.3.2.2?
> Thanks for help and sorry for my English.
> Best regards
> T.  
Yes, that should work fine.  You will need to bind the address to eth0
so that it responds to ARP requests:
ip address add 4.3.2.2/?? dev eth0
Are you sure about the 28 bit mask for the subnets? It looks like you
want /25 unless you are hiding some of your addresses.  Good luck - John
-- 
John A. Sullivan III
Chief Technology Officer
Nexus Management
+1 207-985-7880
john.sullivan@nexusmgmt.com
---
If you are interested in helping to develop a GPL enterprise class
VPN/Firewall/Security device management console, please visit
http://iscs.sourceforge.net 

Re: multiple mapping

[John A. Sullivan III]

On Wed, 2004-09-01 at 07:19, Tomek Macioszek wrote:
> Thanks for help. I have just only one question?
> If I make multiple mapping like this:
> iptables -t nat -A POSTROUTING -s 192.168.10.0/24 -o eth0 -j SNAT --to
> 4.3.2.0/24
> I should bind all this addresses (4.3.2.0/24) to eth0?
> ip address add 4.3.2.2/24 dev eth0
> ip address add 4.3.2.3/24 dev eth0
> ip address add 4.3.2.4/24 dev eth0
> ....
> ip address add 4.3.2.254/24 dev eth0
> Best regards
> T.
<snip>
If that is what you want to do, you will probably want to use the NETMAP
target from patch-o-matic.  The rule that you propose does not guarantee
a one-to-one mapping.  It does a round-robin mapping.  Thus there is no
guarantee that 192.168.10.5 maps to 4.3.2.5. In fact, it most likely
will not.

As far as I know, you will need to bind all of the addresses so that
they respond to the ARP requests.

This is where a tool like ISCS comes in handy
(http://iscs.sourceforge.net).  Not only does it automate the access
control configuration but it automates NAT and ARP.  You would simply
create a server with a private IP address of 192.168.10.1-192.168.10.254
and a public address of 4.3.2.1-4.3.2.254 and check the enforce
one-to-one box.  It would then create all the NAT rules, the address
bindings for ARP and distribute them to the gateway.  The project only
has pre-alpha releases thus far but we are moving quickly toward a full
release.  Good luck - John
-- 
John A. Sullivan III
Open Source Development Corporation
Financially sustainable open source development
http://www.opensourcedevel.com

Re: multiple mapping

[Jose Maria Lopez]

El mié, 01 de 09 de 2004 a las 09:59, Tomek Macioszek escribió:
> Hi
> I have my FIREWALL BOX with address 4.3.2.1 (eth0) and local address 192.168.10.0/24.
> Now I have SNAT:
> iptables -t nat -A POSTROUTING -s 192.168.10.0/24 -o eth1 -j SNAT --to 4.3.2.1
> I would like to make SNAT with i.e two external address.
> iptables -t nat -A POSTROUTING -s 192.168.10.0/28 -o eth1 -j SNAT --to 4.3.2.1
> iptables -t nat -A POSTROUTING -s 192.168.10.128/28 -o eth1 -j SNAT --to 4.3.2.2. It is good solution? Should I make alias for eth0 with address 4.3.2.2?

Yes, it's a good solution, and you can use --to more than once in the
same rule. Check iptables -j SNAT --help.
You should have an alias for the IP if you need routing through the IP,
not only for the SNAT.

> Thanks for help and sorry for my English.
> Best regards
> T.  
-- 
Jose Maria Lopez Hernandez
Director Tecnico de bgSEC
jkerouac@bgsec.com
bgSEC Seguridad y Consultoria de Sistemas Informaticos
http://www.bgsec.com
ESPAÑA

The only people for me are the mad ones -- the ones who are mad to live,
mad to talk, mad to be saved, desirous of everything at the same time,
the ones who never yawn or say a commonplace thing, but burn, burn, burn
like fabulous yellow Roman candles.
                -- Jack Kerouac, "On the Road"