Network mapping from internal and external

Network mapping from internal and external

[Gregory Gerard]

I'm not sure how to describe my setup and intended network in iptables
parlance. Have searched much and can't find anything that matches my
situation.

 

I have 5 static IPs from my ISP. Out the Ethernet end of my DSL box I see
those 5 IPs directly. I have no control over the router but that's fine.

 

I have many more than 5 machines in my network.

 

Internally, I have 10.9.x.x (255.255.0.0).

 

I would like to setup iptables such that 4 of the external IP addresses map
completely map onto exactly 4 internal IP addresses. The fifth external
address will simply be used to NAT for internal only machines.

 

What's the right mix of NICs and settings?

 

I was thinking about bringing up several eth0:1..4 interfaces to accept
those 4 external addresses and map them that way.

 

Suggestions?

 

Thanks!

greg

 

Re: Network mapping from internal and external

[Craig Steadman]

Hi Greg

I've placed the scripts i use on sourceforge
http://bastionx.sourceforge.net
I use it to maintain a VPN on dynamic ip addresses.
It has a alot of coding framework which can be re-used
to create your own scripts.  The sub-interface detection
and ip redirection functions could be useful for you.

Cheers
   Craig

On Mon, 2004-10-04 at 11:42, Gregory Gerard wrote:
> I'm not sure how to describe my setup and intended network in iptables
> parlance. Have searched much and can't find anything that matches my
> situation.
> 
>  
> 
> I have 5 static IPs from my ISP. Out the Ethernet end of my DSL box I see
> those 5 IPs directly. I have no control over the router but that's fine.
> 
>  
> 
> I have many more than 5 machines in my network.
> 
>  
> 
> Internally, I have 10.9.x.x (255.255.0.0).
> 
>  
> 
> I would like to setup iptables such that 4 of the external IP addresses map
> completely map onto exactly 4 internal IP addresses. The fifth external
> address will simply be used to NAT for internal only machines.
> 
>  
> 
> What's the right mix of NICs and settings?
> 
>  
> 
> I was thinking about bringing up several eth0:1..4 interfaces to accept
> those 4 external addresses and map them that way.
> 
>  
> 
> Suggestions?
> 
>  
> 
> Thanks!
> 
> greg
> 
>  

Re: Network mapping from internal and external

[John A. Sullivan III]

On Sun, 2004-10-03 at 23:42, Gregory Gerard wrote:
> I'm not sure how to describe my setup and intended network in iptables
> parlance. Have searched much and can't find anything that matches my
> situation.
> 
>  
> 
> I have 5 static IPs from my ISP. Out the Ethernet end of my DSL box I see
> those 5 IPs directly. I have no control over the router but that's fine.
> 
>  
> 
> I have many more than 5 machines in my network.
> 
>  
> 
> Internally, I have 10.9.x.x (255.255.0.0).
> 
>  
> 
> I would like to setup iptables such that 4 of the external IP addresses map
> completely map onto exactly 4 internal IP addresses. The fifth external
> address will simply be used to NAT for internal only machines.
> 
>  
> 
> What's the right mix of NICs and settings?
> 
>  
> 
> I was thinking about bringing up several eth0:1..4 interfaces to accept
> those 4 external addresses and map them that way.
<snip>
It's reasonably straightforward to accomplish this.  The ISCS project
will do all of this automatically for you -- map the addresses exactly
as you describe and take care of binding the needed addresses addresses
to the NICs (http://iscs.sourceforge.net).  The fully functioning code
has not yet been released but enough of it is there to split out the
rules.

However, if all you have is a single device, you're probably better off
setting it up manually.  The rule order will be important.  I assume you
know which internal addresses you want assigned to the four public
addresses.

You can create an SNAT/DNAT pair for each

iptables -t nat -A PREROUTING -d $PUBIP1 -i $PUBIF -j DNAT
--to-destination $INTIP1
iptables -t nat -A POSTROUTING -s $INTIP1 -o $PUBIF -j SNAT --to-source
$PUBIP1

Then, create another rule for the rest of the protected addresses which
is evaluated after all the other rules which will NAPT them all to a
single public IP address:

iptables -t nat -A POSTROUTING -o $PUBIF -j SNAT --to-source $MAINPUBIP

Then, to enable the public interface to respond to all the ARP requests,
bind the additional addresses to them:

ip address add <PUBIP1>/<MASK LENGTH> dev <PUBIF> brd +

for each public IP.

I think that will do it for you.  Good luck - John
-- 
John A. Sullivan III
Chief Technology Officer
Nexus Management
+1 207-985-7880
john.sullivan@nexusmgmt.com
---
If you are interested in helping to develop a GPL enterprise class
VPN/Firewall/Security device management console, please visit
http://iscs.sourceforge.net 

Re: Network mapping from internal and external

[Jason Opperisano]

On Sun, 2004-10-03 at 23:42, Gregory Gerard wrote:
> I'm not sure how to describe my setup and intended network in iptables
> parlance. Have searched much and can't find anything that matches my
> situation.
> 
>  
> 
> I have 5 static IPs from my ISP. Out the Ethernet end of my DSL box I see
> those 5 IPs directly. I have no control over the router but that's fine.
> 
>  
> 
> I have many more than 5 machines in my network.
> 
>  
> 
> Internally, I have 10.9.x.x (255.255.0.0).
> 
>  
> 
> I would like to setup iptables such that 4 of the external IP addresses map
> completely map onto exactly 4 internal IP addresses. The fifth external
> address will simply be used to NAT for internal only machines.

assuming 1 of the 5 IP's is actually assigned to your netfilter
machine's external nic (i.e. 1.1.1.2), you need to add IP aliases for
the remaining 4 IP's (1.1.1.3 - 1.1.1.6):

ip addr add 1.1.1.3 dev $EXTERNAL_IF
ip addr add 1.1.1.4 dev $EXTERNAL_IF
ip addr add 1.1.1.5 dev $EXTERNAL_IF
ip addr add 1.1.1.6 dev $EXTERNAL_IF

setup 1:1 outbound NAT:

  iptables -t nat -A POSTROUTING -o $EXTERNAL_IF -s 10.9.1.3 \
    -j SNAT --to-source 1.1.1.3
  iptables -t nat -A POSTROUTING -o $EXTERNAL_IF -s 10.9.1.4 \
    -j SNAT --to-source 1.1.1.4
  iptables -t nat -A POSTROUTING -o $EXTERNAL_IF -s 10.9.1.5 \
    -j SNAT --to-source 1.1.1.5
  iptables -t nat -A POSTROUTING -o $EXTERNAL_IF -s 10.9.1.6 \
    -j SNAT --to-source 1.1.1.6

setup many:1 outbound NAT:

  iptables -t nat -A POSTROUTING -o $EXTERNAL_IF -s 10.9.0.0/16 \
    -j SNAT --to-source 1.1.1.2

you don't specifically say whether you want the 4 1:1 NAT's to map for
inbound traffic as well, but if you do:

  iptables -t nat -A PREROUTING -i $EXTERNAL_IF -d 1.1.1.3 \
    -j DNAT --to-destination 10.9.1.3
  iptables -t nat -A PREROUTING -i $EXTERNAL_IF -d 1.1.1.4 \
    -j DNAT --to-destination 10.9.1.4
  iptables -t nat -A PREROUTING -i $EXTERNAL_IF -d 1.1.1.5 \
    -j DNAT --to-destination 10.9.1.5
  iptables -t nat -A PREROUTING -i $EXTERNAL_IF -d 1.1.1.6 \
    -j DNAT --to-destination 10.9.1.6

-j

-- 
Jason Opperisano <opie@817west.com>