Multiple Source IP Addresses

Multiple Source IP Addresses

[Dennis O. Aliev]

Good evening,

Is there a way to send traffic from host behind IPTables firewall using different external source IP addresses that are assigned to firewall on the external interface?

Host behind firewall has single IP address (192.168.1.94)  and making  http based requests to internet.

Firewall has following rules to make it work:
iptables -t filter -A forward -o eth0 -p tcp -s 192.168.1.94 --dport 80 -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -s 192.168.1.94 -j SNAT --to-source some_external_ip

I was thinking of making http request from host to a different port and then based on that change source address to another external address and change the destination port to 80, but can't figure out how to do that.

Does anyone have any ideas? Perhaps there is a different approach?
-- 

Dennis O. Aliev 

RE: Multiple Source IP Addresses

[Baake, Matthias]

If i understood it the right way you want to map an internal machine (e.g. Webserver) to an external address.
Then you have to make a Rule into NAT Prerouting to redirect specific Traffic to the internal machine.

IPTABLES -t nat -A PREROUTING -i $EXT_IF -d $Your_ext_ip -j DNAT --to-destination $IP_OF_YOUR_INTERNAL_WEBSERVER

The filtering for this map you can still do in the filter table. Like your rule you already posted.
This way your Internal Webserver should be reachable from the Internet.

/matthias baake



-----Original Message-----
From: netfilter-bounces@lists.netfilter.org
[mailto:netfilter-bounces@lists.netfilter.org]On Behalf Of Dennis O.
Aliev
Sent: Friday, March 11, 2005 4:50 AM
To: netfilter@lists.netfilter.org
Cc: sergey@etecom.com; daliev@etecom.com
Subject: Multiple Source IP Addresses


Good evening,

Is there a way to send traffic from host behind IPTables firewall using different external source IP addresses that are assigned to firewall on the external interface?

Host behind firewall has single IP address (192.168.1.94)  and making  http based requests to internet.

Firewall has following rules to make it work:
iptables -t filter -A forward -o eth0 -p tcp -s 192.168.1.94 --dport 80 -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -s 192.168.1.94 -j SNAT --to-source some_external_ip

I was thinking of making http request from host to a different port and then based on that change source address to another external address and change the destination port to 80, but can't figure out how to do that.

Does anyone have any ideas? Perhaps there is a different approach?
-- 

Dennis O. Aliev 

Re: Multiple Source IP Addresses

[Dennis O. Aliev]

Baake,

Thank you for reply.

What you suggesting will take care of routing incomming packets (from internet) to web server. In my scenario, I have a bot that parses sites and so the packets are coming from webserver to internet and source addresses must be different to load balance between internet connections.

-- 

Dennis O. Aliev 
 
On Fri, 11 Mar 2005 09:21:40 +0100
"Baake, Matthias" <m.baake@porta.de> wrote:

> If i understood it the right way you want to map an internal machine (e.g. Webserver) to an external address.
> Then you have to make a Rule into NAT Prerouting to redirect specific Traffic to the internal machine.
> 
> IPTABLES -t nat -A PREROUTING -i $EXT_IF -d $Your_ext_ip -j DNAT --to-destination $IP_OF_YOUR_INTERNAL_WEBSERVER
> 
> The filtering for this map you can still do in the filter table. Like your rule you already posted.
> This way your Internal Webserver should be reachable from the Internet.
> 
> /matthias baake
> 
> 
> 
> -----Original Message-----
> From: netfilter-bounces@lists.netfilter.org
> [mailto:netfilter-bounces@lists.netfilter.org]On Behalf Of Dennis O.
> Aliev
> Sent: Friday, March 11, 2005 4:50 AM
> To: netfilter@lists.netfilter.org
> Cc: sergey@etecom.com; daliev@etecom.com
> Subject: Multiple Source IP Addresses
> 
> 
> Good evening,
> 
> Is there a way to send traffic from host behind IPTables firewall using different external source IP addresses that are assigned to firewall on the external interface?
> 
> Host behind firewall has single IP address (192.168.1.94)  and making  http based requests to internet.
> 
> Firewall has following rules to make it work:
> iptables -t filter -A forward -o eth0 -p tcp -s 192.168.1.94 --dport 80 -j ACCEPT
> iptables -t nat -A POSTROUTING -o eth0 -s 192.168.1.94 -j SNAT --to-source some_external_ip
> 
> I was thinking of making http request from host to a different port and then based on that change source address to another external address and change the destination port to 80, but can't figure out how to do that.
> 
> Does anyone have any ideas? Perhaps there is a different approach?
> -- 
> 
> Dennis O. Aliev 

Re: Multiple Source IP Addresses

[Jason Opperisano]

On Fri, 2005-03-11 at 14:40, Dennis O. Aliev wrote:
> Baake,
> 
> Thank you for reply.
> 
> What you suggesting will take care of routing incomming packets (from internet) to web server. In my scenario, I have a bot that parses sites and so the packets are coming from webserver to internet and source addresses must be different to load balance between internet connections.

use multiple "--to-source" options in your SNAT rule:

  iptables -t nat -A POSTROUTING -o $EXT_IF -s $WEB_SRV_IP \
    -j SNAT --to-source $EXTIP1 --to-source $EXTIP2  --to-source $EXTIP3

outbound connections will round-robin between the source addresses.

-j

--
"Alright brain, you don't like me and I don't like you. But let's just
 get through this and then I can get back to killing you with beer."
	--The Simpsons

Re: Multiple Source IP Addresses

[Dennis O. Aliev]

Jason,

This is a great solution, but it has 1 limitation. There would be no way for webserver to track how many requests went through each external IP. Would you have any further suggestions?

Thanks a lot.

Dennis O. Aliev


On Fri, 11 Mar 2005 14:49:51 -0500
Jason Opperisano <opie@817west.com> wrote:

> On Fri, 2005-03-11 at 14:40, Dennis O. Aliev wrote:
> > Baake,
> > 
> > Thank you for reply.
> > 
> > What you suggesting will take care of routing incomming packets (from internet) to web server. In my scenario, I have a bot that parses sites and so the packets are coming from webserver to internet and source addresses must be different to load balance between internet connections.
> 
> use multiple "--to-source" options in your SNAT rule:
> 
>   iptables -t nat -A POSTROUTING -o $EXT_IF -s $WEB_SRV_IP \
>     -j SNAT --to-source $EXTIP1 --to-source $EXTIP2  --to-source $EXTIP3
> 
> outbound connections will round-robin between the source addresses.
> 
> -j
> 
> --
> "Alright brain, you don't like me and I don't like you. But let's just
>  get through this and then I can get back to killing you with beer."
> 	--The Simpsons
> 

Re: Multiple Source IP Addresses

[Dennis O. Aliev]

Jason,

This is a great solution, but it has 1 limitation. There would be no way for webserver to track how many requests went through each external IP. Would you have any further suggestions?

Thanks a lot.

Dennis O. Aliev


On Fri, 11 Mar 2005 14:49:51 -0500
Jason Opperisano <opie@817west.com> wrote:

> On Fri, 2005-03-11 at 14:40, Dennis O. Aliev wrote:
> > Baake,
> > 
> > Thank you for reply.
> > 
> > What you suggesting will take care of routing incomming packets (from internet) to web server. In my scenario, I have a bot that parses sites and so the packets are coming from webserver to internet and source addresses must be different to load balance between internet connections.
> 
> use multiple "--to-source" options in your SNAT rule:
> 
>   iptables -t nat -A POSTROUTING -o $EXT_IF -s $WEB_SRV_IP \
>     -j SNAT --to-source $EXTIP1 --to-source $EXTIP2  --to-source $EXTIP3
> 
> outbound connections will round-robin between the source addresses.
> 
> -j
> 
> --
> "Alright brain, you don't like me and I don't like you. But let's just
>  get through this and then I can get back to killing you with beer."
> 	--The Simpsons
> 
-- 

---------------------------------------------
  Dennis O. Aliev 
  Sr. Systems Engineer 
---------------------------------------------
  IT Department
  Einstein Industries, Inc.
  www.einsteinindustries.com

  Toll:   (800) 258-9221 x 4957 
  Direct: (858) 362-4957
  Fax:    (858) 452-8672
  Email:  doa@einsteinindustries.com
---------------------------------------------