[LARTC] Ip Src rewite.

[LARTC] Ip Src rewite.

[Daniel Frederiksen]

Hello folks..

Does any of you know if it is possible to rewrite the ip src in a packet.
I have a problem involving a DMZ with external IP addresses routed 
trough a single WAN IP. When the server initiates a connection, it looks 
like it comes from the WAN ip instead of it's designated External IP 
routed through the WAN.
So in short, Is it possible to rewrite the packet in the router, with 
Iptables, to make it look like it comes from the external IP address 
instead of the WAN IP of the router/firewall.

Thank you very much for your time, I appreciate it.

/Daniel Frederiksen


NB: Small diagram of the setup.

   DMZ                     GW/FW           ISP/Internet
-----------------------------------------------------------------------
   Server #1  --|
   e.f.g.h3/26  |
                |---- Gateway/Firewall --- ISP  WAN IP: a.b.c.d/30
   Server #2  --|      a.b.c.d1/30         Ext. IP: e.f.g.h/26
   e.f.g.h4/26         e.f.g.h1/26
----------------------------------------------------------------------

_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

Re: [LARTC] Ip Src rewite.

[Oscar Mechanic]

Maybe I have missed somthing and you need to do it in POSTROUTING but
how about SNAT.

PS: ip can do stateless nat.

On Tue, 2005-
10-25 at 14:36 +0200, Daniel Frederiksen wrote:
> Hello folks..
> 
> Does any of you know if it is possible to rewrite the ip src in a packet.
> I have a problem involving a DMZ with external IP addresses routed 
> trough a single WAN IP. When the server initiates a connection, it looks 
> like it comes from the WAN ip instead of it's designated External IP 
> routed through the WAN.
> So in short, Is it possible to rewrite the packet in the router, with 
> Iptables, to make it look like it comes from the external IP address 
> instead of the WAN IP of the router/firewall.
> 
> Thank you very much for your time, I appreciate it.
> 
> /Daniel Frederiksen
> 
> 
> NB: Small diagram of the setup.
> 
>    DMZ                     GW/FW           ISP/Internet
> -----------------------------------------------------------------------
>    Server #1  --|
>    e.f.g.h3/26  |
>                 |---- Gateway/Firewall --- ISP  WAN IP: a.b.c.d/30
>    Server #2  --|      a.b.c.d1/30         Ext. IP: e.f.g.h/26
>    e.f.g.h4/26         e.f.g.h1/26
> ----------------------------------------------------------------------
> 
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

Re: [LARTC] Ip Src rewite.

[Daniel Frederiksen]

Oscar Mechanic wrote:
> Maybe I have missed somthing and you need to do it in POSTROUTING but
> how about SNAT.
> 

Well currently I do not NAT at all. I have ip_forwarding enabled and 
have assigned the first IP from the external block on the inside of the 
Gateway/Firewall. On the outside of the Gateway/Firewall I have assigned 
the WAN IP. This way when a system on the DMZ establishes a connection 
it is forwarded through the Gateway.

Any suggestions to changes are appreciated.

/Daniel..

> PS: ip can do stateless nat.
> 
> On Tue, 2005-
> 10-25 at 14:36 +0200, Daniel Frederiksen wrote:
> 
>>Hello folks..
>>
>>Does any of you know if it is possible to rewrite the ip src in a packet.
>>I have a problem involving a DMZ with external IP addresses routed 
>>trough a single WAN IP. When the server initiates a connection, it looks 
>>like it comes from the WAN ip instead of it's designated External IP 
>>routed through the WAN.
>>So in short, Is it possible to rewrite the packet in the router, with 
>>Iptables, to make it look like it comes from the external IP address 
>>instead of the WAN IP of the router/firewall.
>>
>>Thank you very much for your time, I appreciate it.
>>
>>/Daniel Frederiksen
>>
>>
>>NB: Small diagram of the setup.
>>
>>   DMZ                     GW/FW           ISP/Internet
>>-----------------------------------------------------------------------
>>   Server #1  --|
>>   e.f.g.h3/26  |
>>                |---- Gateway/Firewall --- ISP  WAN IP: a.b.c.d/30
>>   Server #2  --|      a.b.c.d1/30         Ext. IP: e.f.g.h/26
>>   e.f.g.h4/26         e.f.g.h1/26
>>----------------------------------------------------------------------
>>
>>_______________________________________________
>>LARTC mailing list
>>LARTC@mailman.ds9a.nl
>>http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
> 
> 


_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

Re: [LARTC] Ip Src rewite.

[Oscar Mechanic]

So you want packets leaving the WAN to have address e.f.g.h/26 rather
than a.b.c.d/30

That would mean you ISP has assigned you the two ranges e.f.g.h and
a.b.c.d.

Your gateway cannot be a gateway from this diagram 

    That must be e.f.g.h/27   GW has
                     e.f.g.h/27 and e.f.g.h/26 interfaces 
> >>   DMZ                     GW/FW           ISP/Internet
> >>-----------------------------------------------------------------------
> >>   Server #1  --|
> >>   e.f.g.h3/26  |
> >>                |---- Gateway/Firewall --- ISP  WAN IP: a.b.c.d/30
> >>   Server #2  --|      a.b.c.d1/30         Ext. IP: e.f.g.h/26
> >>   e.f.g.h4/26         e.f.g.h1/26
> >>----------------------------------------------------------------------

I would assume what you will end up doing is

iptables -t nat -A POSTROUTING -m mac-source <MACSERVER1> -j SNAT --to-
source <ALIAS1 of GW>
iptables -t nat -A POSTROUTING -m mac-source <MACSERVER2> -j SNAT --to-
source <ALIAS2 of GW>

Where ALIAS1 and ALIAS2 are the IP's of server 1 and server 2 aliased on
the firewall

Regards
Shane
 
On Tue, 2005-10-25 at 14:58 +0200, Daniel Frederiksen wrote:
> Oscar Mechanic wrote:
> > Maybe I have missed somthing and you need to do it in POSTROUTING but
> > how about SNAT.
> > 
> 
> Well currently I do not NAT at all. I have ip_forwarding enabled and 
> have assigned the first IP from the external block on the inside of the 
> Gateway/Firewall. On the outside of the Gateway/Firewall I have assigned 
> the WAN IP. This way when a system on the DMZ establishes a connection 
> it is forwarded through the Gateway.
> 
> Any suggestions to changes are appreciated.
> 
> /Daniel..
> 
> > PS: ip can do stateless nat.
> > 
> > On Tue, 2005-
> > 10-25 at 14:36 +0200, Daniel Frederiksen wrote:
> > 
> >>Hello folks..
> >>
> >>Does any of you know if it is possible to rewrite the ip src in a packet.
> >>I have a problem involving a DMZ with external IP addresses routed 
> >>trough a single WAN IP. When the server initiates a connection, it looks 
> >>like it comes from the WAN ip instead of it's designated External IP 
> >>routed through the WAN.
> >>So in short, Is it possible to rewrite the packet in the router, with 
> >>Iptables, to make it look like it comes from the external IP address 
> >>instead of the WAN IP of the router/firewall.
> >>
> >>Thank you very much for your time, I appreciate it.
> >>
> >>/Daniel Frederiksen
> >>
> >>
> >>NB: Small diagram of the setup.
> >>
> >>   DMZ                     GW/FW           ISP/Internet
> >>-----------------------------------------------------------------------
> >>   Server #1  --|
> >>   e.f.g.h3/26  |
> >>                |---- Gateway/Firewall --- ISP  WAN IP: a.b.c.d/30
> >>   Server #2  --|      a.b.c.d1/30         Ext. IP: e.f.g.h/26
> >>   e.f.g.h4/26         e.f.g.h1/26
> >>----------------------------------------------------------------------
> >>
> >>_______________________________________________
> >>LARTC mailing list
> >>LARTC@mailman.ds9a.nl
> >>http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
> > 
> > 
> 
> 
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

Re: [LARTC] Ip Src rewite.

[Oscar Mechanic]

excuse my iptables

-m mac --mac-source 00:20:23:20:20:20

You will do this cause you dont want your 26 to become a 27 and loose 3
addrs.

Alias are no longer called aliases but for convenience



On Tue, 2005-10-25 at 14:21 +0100, Oscar Mechanic wrote:
> So you want packets leaving the WAN to have address e.f.g.h/26 rather
> than a.b.c.d/30
> 
> That would mean you ISP has assigned you the two ranges e.f.g.h and
> a.b.c.d.
> 
> Your gateway cannot be a gateway from this diagram 
> 
>     That must be e.f.g.h/27   GW has
>                      e.f.g.h/27 and e.f.g.h/26 interfaces 
> > >>   DMZ                     GW/FW           ISP/Internet
> > >>-----------------------------------------------------------------------
> > >>   Server #1  --|
> > >>   e.f.g.h3/26  |
> > >>                |---- Gateway/Firewall --- ISP  WAN IP: a.b.c.d/30
> > >>   Server #2  --|      a.b.c.d1/30         Ext. IP: e.f.g.h/26
> > >>   e.f.g.h4/26         e.f.g.h1/26
> > >>----------------------------------------------------------------------
> 
> I would assume what you will end up doing is
> 
> iptables -t nat -A POSTROUTING -m mac-source <MACSERVER1> -j SNAT --to-
> source <ALIAS1 of GW>
> iptables -t nat -A POSTROUTING -m mac-source <MACSERVER2> -j SNAT --to-
> source <ALIAS2 of GW>
> 
> Where ALIAS1 and ALIAS2 are the IP's of server 1 and server 2 aliased on
> the firewall
> 
> Regards
> Shane
>  
> On Tue, 2005-10-25 at 14:58 +0200, Daniel Frederiksen wrote:
> > Oscar Mechanic wrote:
> > > Maybe I have missed somthing and you need to do it in POSTROUTING but
> > > how about SNAT.
> > > 
> > 
> > Well currently I do not NAT at all. I have ip_forwarding enabled and 
> > have assigned the first IP from the external block on the inside of the 
> > Gateway/Firewall. On the outside of the Gateway/Firewall I have assigned 
> > the WAN IP. This way when a system on the DMZ establishes a connection 
> > it is forwarded through the Gateway.
> > 
> > Any suggestions to changes are appreciated.
> > 
> > /Daniel..
> > 
> > > PS: ip can do stateless nat.
> > > 
> > > On Tue, 2005-
> > > 10-25 at 14:36 +0200, Daniel Frederiksen wrote:
> > > 
> > >>Hello folks..
> > >>
> > >>Does any of you know if it is possible to rewrite the ip src in a packet.
> > >>I have a problem involving a DMZ with external IP addresses routed 
> > >>trough a single WAN IP. When the server initiates a connection, it looks 
> > >>like it comes from the WAN ip instead of it's designated External IP 
> > >>routed through the WAN.
> > >>So in short, Is it possible to rewrite the packet in the router, with 
> > >>Iptables, to make it look like it comes from the external IP address 
> > >>instead of the WAN IP of the router/firewall.
> > >>
> > >>Thank you very much for your time, I appreciate it.
> > >>
> > >>/Daniel Frederiksen
> > >>
> > >>
> > >>NB: Small diagram of the setup.
> > >>
> > >>   DMZ                     GW/FW           ISP/Internet
> > >>-----------------------------------------------------------------------
> > >>   Server #1  --|
> > >>   e.f.g.h3/26  |
> > >>                |---- Gateway/Firewall --- ISP  WAN IP: a.b.c.d/30
> > >>   Server #2  --|      a.b.c.d1/30         Ext. IP: e.f.g.h/26
> > >>   e.f.g.h4/26         e.f.g.h1/26
> > >>----------------------------------------------------------------------
> > >>
> > >>_______________________________________________
> > >>LARTC mailing list
> > >>LARTC@mailman.ds9a.nl
> > >>http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
> > > 
> > > 
> > 
> > 
> > _______________________________________________
> > LARTC mailing list
> > LARTC@mailman.ds9a.nl
> > http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
> 
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

Re: [LARTC] Ip Src rewite.

[Daniel Frederiksen]

Oscar Mechanic wrote:
> So you want packets leaving the WAN to have address e.f.g.h/26 rather
> than a.b.c.d/30
> 
> That would mean you ISP has assigned you the two ranges e.f.g.h and
> a.b.c.d.

Well, yes my ISP has assigned me the two "classes", however the 
a.b.c.d/30 is a single IP through which the e.f.g.h/26 are routed 
through. The ISP is not routing the e.f.g.h/26 directly to the line, but 
  through the single WAN IP a.b.c.e/30..
This is why all traffic going through is touched and marked as coming 
from the WAN instead of the External IP address.

Any suggestions to solving that?.

/Daniel

> 
> Your gateway cannot be a gateway from this diagram 
> 
>     That must be e.f.g.h/27   GW has
>                      e.f.g.h/27 and e.f.g.h/26 interfaces 
> 
>>>>  DMZ                     GW/FW           ISP/Internet
>>>>-----------------------------------------------------------------------
>>>>  Server #1  --|
>>>>  e.f.g.h3/26  |
>>>>               |---- Gateway/Firewall --- ISP  WAN IP: a.b.c.d/30
>>>>  Server #2  --|      a.b.c.d1/30         Ext. IP: e.f.g.h/26
>>>>  e.f.g.h4/26         e.f.g.h1/26
>>>>----------------------------------------------------------------------
> 
> 
> I would assume what you will end up doing is
> 
> iptables -t nat -A POSTROUTING -m mac-source <MACSERVER1> -j SNAT --to-
> source <ALIAS1 of GW>
> iptables -t nat -A POSTROUTING -m mac-source <MACSERVER2> -j SNAT --to-
> source <ALIAS2 of GW>
> 
> Where ALIAS1 and ALIAS2 are the IP's of server 1 and server 2 aliased on
> the firewall
> 
> Regards
> Shane
>  
> On Tue, 2005-10-25 at 14:58 +0200, Daniel Frederiksen wrote:
> 
>>Oscar Mechanic wrote:
>>
>>>Maybe I have missed somthing and you need to do it in POSTROUTING but
>>>how about SNAT.
>>>
>>
>>Well currently I do not NAT at all. I have ip_forwarding enabled and 
>>have assigned the first IP from the external block on the inside of the 
>>Gateway/Firewall. On the outside of the Gateway/Firewall I have assigned 
>>the WAN IP. This way when a system on the DMZ establishes a connection 
>>it is forwarded through the Gateway.
>>
>>Any suggestions to changes are appreciated.
>>
>>/Daniel..
>>
>>
>>>PS: ip can do stateless nat.
>>>
>>>On Tue, 2005-
>>>10-25 at 14:36 +0200, Daniel Frederiksen wrote:
>>>
>>>
>>>>Hello folks..
>>>>
>>>>Does any of you know if it is possible to rewrite the ip src in a packet.
>>>>I have a problem involving a DMZ with external IP addresses routed 
>>>>trough a single WAN IP. When the server initiates a connection, it looks 
>>>>like it comes from the WAN ip instead of it's designated External IP 
>>>>routed through the WAN.
>>>>So in short, Is it possible to rewrite the packet in the router, with 
>>>>Iptables, to make it look like it comes from the external IP address 
>>>>instead of the WAN IP of the router/firewall.
>>>>
>>>>Thank you very much for your time, I appreciate it.
>>>>
>>>>/Daniel Frederiksen
>>>>
>>>>
>>>>NB: Small diagram of the setup.
>>>>
>>>>  DMZ                     GW/FW           ISP/Internet
>>>>-----------------------------------------------------------------------
>>>>  Server #1  --|
>>>>  e.f.g.h3/26  |
>>>>               |---- Gateway/Firewall --- ISP  WAN IP: a.b.c.d/30
>>>>  Server #2  --|      a.b.c.d1/30         Ext. IP: e.f.g.h/26
>>>>  e.f.g.h4/26         e.f.g.h1/26
>>>>----------------------------------------------------------------------
>>>>
>>>>_______________________________________________
>>>>LARTC mailing list
>>>>LARTC@mailman.ds9a.nl
>>>>http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
>>>
>>>
>>
>>_______________________________________________
>>LARTC mailing list
>>LARTC@mailman.ds9a.nl
>>http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
> 
> 


_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

Re: [LARTC] Ip Src rewite.

[/dev/rob0]

On Tuesday 2005-October-25 17:03, Daniel Frederiksen wrote:
> Well, yes my ISP has assigned me the two "classes", however the
> a.b.c.d/30 is a single IP through which the e.f.g.h/26 are routed
> through. The ISP is not routing the e.f.g.h/26 directly to the line,
> but through the single WAN IP a.b.c.e/30..
> This is why all traffic going through is touched and marked as coming
> from the WAN instead of the External IP address.

What you describe sounds like NAT. Your gateway should be forwarding 
that traffic with the source IP unchanged. Can you show us tcpdump or 
iptables -j LOG of some of these packets' source IP being changed?

I think we are missing part of the picture here. iptables-save; ip r l; 
ip ru l; ip a l # all those might help. Munge consistently if you feel 
compelled to munge.

> >>>>NB: Small diagram of the setup.
> >>>>
> >>>>  DMZ                     GW/FW           ISP/Internet
> >>>>-----------------------------------------------------------------
> >>>>------ Server #1  --|
> >>>>  e.f.g.h3/26  |
> >>>>
> >>>>               |---- Gateway/Firewall --- ISP  WAN IP: a.b.c.d/30
> >>>>
> >>>>  Server #2  --|      a.b.c.d1/30         Ext. IP: e.f.g.h/26
> >>>>  e.f.g.h4/26         e.f.g.h1/26

"DMZ" implies there is a separate subnet, and perhaps a SNAT'ed LAN, 
correct? You have 3 interfaces: internal, DMZ and external? Whether or 
not there is an internal doesn't directly affect this, but anyway, that 
is how I would set it up.

Your DMZ machines should have e.f.g.h1 as their default gateway. Your 
router machine should have whatever the ISP told you to use as its 
default gateway (probably a.b.c.d2, I bet.)
-- 
    mail to this address is discarded unless "/dev/rob0"
    or "not-spam" is in Subject: header
_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc

Re: [LARTC] Ip Src rewite.

[Daniel Frederiksen]

/dev/rob0 wrote:
> On Tuesday 2005-October-25 17:03, Daniel Frederiksen wrote:
> 
>>Well, yes my ISP has assigned me the two "classes", however the
>>a.b.c.d/30 is a single IP through which the e.f.g.h/26 are routed
>>through. The ISP is not routing the e.f.g.h/26 directly to the line,
>>but through the single WAN IP a.b.c.e/30..
>>This is why all traffic going through is touched and marked as coming
>>from the WAN instead of the External IP address.
> 
> 
> What you describe sounds like NAT. Your gateway should be forwarding 
> that traffic with the source IP unchanged. Can you show us tcpdump or 
> iptables -j LOG of some of these packets' source IP being changed?

I would like to supply some tcpdump data, but at the moment the amount 
of data flowing through is massive and extends to 118 systems. I was 
actually trying to simplify the scenario a little bit. The thing is I 
also have multiple lines with the same config running through the 
gateway/firewall as a multipath routed setup.
Ok here goes, I'll try to define the complete setup:

eth0 (WAN 1)
IP: 80.16x.xxx.70/30

eth1 (WAN 2)
IP: 80.16y.yyy.174/30

eth2 (Routed WAN 2 Class)
IP: 80.16z.zzz.65/26

eth3 (Routed WAN 1 Class)
IP: 62.24w.www.1/26

eth4
IP: 192.168.1.1/24


:~# ip ru
0:      from all lookup local
32761:  from 80.16x.xxx.70 lookup WAN1
32762:  from 62.24w.www.0/26 lookup WAN1
32763:  from 80.16z.zzz.64/26 lookup WAN2
32764:  from 80.16y.yyy.174 lookup WAN2
32766:  from all lookup main
32767:  from all lookup default

:~# ip r
80.16y.yyy.172/30 dev eth1  proto kernel  scope link  src 80.16y.yyy.174
80.16x.xxx.68/30 dev eth0  proto kernel  scope link  src 80.16x.xxx.70
80.16z.zzz.64/26 dev eth2  proto kernel  scope link  src 80.16z.zzz.65
62.24w.www.0/26 dev eth3  proto kernel  scope link  src 62.24w.www.1
192.168.1.0/24 dev eth4  proto kernel  scope link  src 192.168.1.1
default via 80.16x.xxx.69 dev eth0

The only other settings are:
echo "1" > /proc/sys/net/ipv4/ip_forward

iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to 80.16x.xxx.70

D'ooohhhh (Slaps his forehead)..
Just found the problem.. Missing a "-s 192.168.1.0/24" in the above 
statement, to exclude everything except the LAN.. No wonder everything 
got nat'ed..

Well, I guess I'm buying the next round..

Anyway, thanks allot guys. You made my day and night..

/Daniel.





> 
> I think we are missing part of the picture here. iptables-save; ip r l; 
> ip ru l; ip a l # all those might help. Munge consistently if you feel 
> compelled to munge.
> 
> 
>>>>>>NB: Small diagram of the setup.
>>>>>>
>>>>>> DMZ                     GW/FW           ISP/Internet
>>>>>>-----------------------------------------------------------------
>>>>>>------ Server #1  --|
>>>>>> e.f.g.h3/26  |
>>>>>>
>>>>>>              |---- Gateway/Firewall --- ISP  WAN IP: a.b.c.d/30
>>>>>>
>>>>>> Server #2  --|      a.b.c.d1/30         Ext. IP: e.f.g.h/26
>>>>>> e.f.g.h4/26         e.f.g.h1/26
> 
> 
> "DMZ" implies there is a separate subnet, and perhaps a SNAT'ed LAN, 
> correct? You have 3 interfaces: internal, DMZ and external? Whether or 
> not there is an internal doesn't directly affect this, but anyway, that 
> is how I would set it up.
> 
> Your DMZ machines should have e.f.g.h1 as their default gateway. Your 
> router machine should have whatever the ISP told you to use as its 
> default gateway (probably a.b.c.d2, I bet.)


_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc