Re: [LARTC] What Cisco calls 'Overloading NAT'??

[Oscar Mechanic <oscar@ufomechanic.net>]

If I was thee I would install iptables. To my knowledge the nat
implementation in ip is stateless so you could not use it for that but I
stand to be corrected.

You could do a nice implementation using nth or random on SNAT. So if it
is a new connections using connstate then put it into nth off a SNAT
target and conntrack will do the rest for you.

Of coarse all of this is useless if you dont have iptables. But
ubuntu/debian rpms are top class.

You did not say what session proto you were using. Oh I just remembered
something if you are using SIP then you will have to be able to catch
the RTP channel and nat them the same.  

The SNAT target in iptables has a round robin feature but I think the
above point will be a problem.

On Thu, 2005-11-10 at 10:16 -0600, David Sims wrote:
> Hi Oscar,
> 
>   I am doing the existing routing (only!) with a pretty bare Ubuntu server
> install... i.e., no firewall and no iptables at this point.... Cisco (in
> at least some software) allows many:1 NAT with a pool of NAT addresses
> rather than a single address.... This way, every connection seems to come
> from a different post-NAT address (at least up to the number of addresses
> in the pool).... I am curious if Linux iproute2 supports this concept??
> 
> Dave
> *************************************************************************
> On Thu, 10 Nov 2005, Oscar Mechanic wrote:
> 
> > Is that not multiple NETMAP entries in iptables. Are you using
> > SIP/H323/MGCP
> >
> >
> > On Wed, 2005-11-09 at 09:02 -0600, David Sims wrote:
> > > Hi,
> > >
> > >   Is there a way in Linux to do NAT with a pool of outside addresses such
> > > that each connection to the outside resource gets a different IP address??
> > > I don't want 1:1 NAT as I have some thousands of IP addresses on one side
> > > of the LARTC router that _may_ need to access a resource on the other
> > > side... The resource needs to see a different IP address for each active
> > > call, but these addresses can be reused after the call concludes....
> > >
> > >   Any clues??
> > >
> > > TIA,
> > >
> > > Dave
> > > _______________________________________________
> > > LARTC mailing list
> > > LARTC@mailman.ds9a.nl
> > > http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
> >

_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc