Local to Local via firewall

Local to Local via firewall

[Andrew Clayton]

Hi,

Starting to bang my head against the proverbial wall ;)

The set up is relatively simple.

Internet <----> Firewall <----> Office.

The office network is on a 192.168.1.x range. And outgoing traffic is
SNAT'd.

The firewall is set as the default gateway for all office machines.

We also have internet routeable IP addresses, that allow us to access
various machines in the office from outside with rules like (names
changed to protect the innocent)

$IPTABLES -t nat -A PREROUTING -s $SOME_EXTERNAL_HOST -p tcp -d $HOST_E
 --dport 22 -j DNAT --to-destination $HOST_I

$HOST_E is the internet routeable IP address, this IP is configured on the firewall.
$HOST_I is the 192.168.1,x address that we use to access the machine by in the office.

So we have host.foo.co.uk ($HOST_E) when accessing it from outside the office and host.foo.bar 
($HOST_I) when accessing it from inside the office and doesn't go via the firewall.

This works OK. But it would be much nicer if we could just use host.foo.co.uk 
all the time. 

Without adding any extra rules, an ssh to host.foo.co.uk naturally just lands on the 
firewall. What I've been trying to do is add a rule that will allow an ssh to host.foo.co.uk
(which resolves to its internet IP address) but make the connection go to its internal IP
address.

I've tried many different things, with one of two usual outcomes.

1) The ssh just goes to the firewall
2) No ssh connection is made and I get the following logged.

IN=eth1 OUT=eth1 SRC=192.168.1.20 DST=192.168.1.128 LEN=60 
TOS=0x00 PREC=0x00 TTL=63 ID=53892 DF PROTO=TCP SPT=39355 
DPT=22 WINDOW=5840 RES=0x00 CWR ECE SYN URGP=0 

192.168.1.20 is my workstation and 192.168.1.128 is the internal IP
of the machine I'm trying to ssh to as host.foo.co.uk (that I can ssh 
in on host.foo.bar).
 
The rule that does 2 from above is

$IPTABLES -t nat -A PREROUTING -s 192.168.0.0/16 -p tcp -d $HOST_E --dport 22 -j 
DNAT --to-destination $HOST_I

Which is basically the same as our other DNAT rules for accessing
internal machines from outside the office. Which is probably not right
seeing as it's coming from the internal network in the first place.

I can't help but think I'm missing something simple. Then again does
what I'm trying to do make sense?

This is on a stock CentOS 5.3 with iptables v1.3.5

Any insights would be greatly appreciated.


Cheers,
Andrew

Re: Local to Local via firewall

[Thomas Jacob]

On Fri, 2009-07-31 at 14:42 +0100, Andrew Clayton wrote:
[.. accessing outside IPs on a NAT router from
the inside network ...]

> I can't help but think I'm missing something simple. Then again does
> what I'm trying to do make sense?

Just don't DNAT/SNAT packets from the internal network to
your public IPs, there is no need for it anyway.

e.g. do something like this before your other DNATs

$IPTABLES -t nat -A PREROUTING -i eth1 -s 192.168.0.0/16 -p tcp -d
$HOST_E -j RETURN

Plus, of course, you need to allow access to that IP/port from the
internal network in the INPUT chain of the filter table.

Re: Local to Local via firewall

[Andrew Clayton]

On Fri, 31 Jul 2009 18:06:21 +0200, Thomas Jacob wrote:

> On Fri, 2009-07-31 at 14:42 +0100, Andrew Clayton wrote:
> [.. accessing outside IPs on a NAT router from
> the inside network ...]
> 
> > I can't help but think I'm missing something simple. Then again does
> > what I'm trying to do make sense?
> 
> Just don't DNAT/SNAT packets from the internal network to
> your public IPs, there is no need for it anyway.
> 
> e.g. do something like this before your other DNATs
> 
> $IPTABLES -t nat -A PREROUTING -i eth1 -s 192.168.0.0/16 -p tcp -d
> $HOST_E -j RETURN
> 
> Plus, of course, you need to allow access to that IP/port from the
> internal network in the INPUT chain of the filter table.

Thanks for the reply. Unfortunately with the above rule, the ssh just
ends up going to the firewall and not the host. The firewall is
configured with the IP address of $HOST_E which is where the DNAT comes
in to change it to it's internal IP.

It seems what I'm trying to do now is something like:

internal (workstation)--> external ($HOST_E)--> internal ($HOST_I)

I could fudge /etc/hosts on machines with the hosts external DNS name
pointing to its internal IP address, but doing it with the firewall
seems better.

e.g 
host.foo.co.uk has an IP of aaa.aaa.aaa.aaa (accessible from outside the
office)
host.foo.bar (internal only DNS name) has an IP of bbb.bbb.bbb.bbb

I can put 

bbb.bbb.bbb.bbb foo.co.uk

in my /etc/hosts file, and then ssh foo.co.uk, works.

But I do think the firewall is the proper place to do this.


Cheers,
Andrew


-- 
On Jack's day off, he and Edgar would shoot hoops and get ice cream
together. Later, they'd prank call Chloe, only to have her trace the
call, call them back and tell them to "grow up". Good times... good
times.

Re: Local to Local via firewall

[Robby Workman]

[-- Attachment #1: Type: text/plain, Size: 2255 bytes --]

On Fri, 31 Jul 2009 17:24:19 +0100
Andrew Clayton <andrew@digital-domain.net> wrote:

> On Fri, 31 Jul 2009 18:06:21 +0200, Thomas Jacob wrote:
> 
> > On Fri, 2009-07-31 at 14:42 +0100, Andrew Clayton wrote:
> > [.. accessing outside IPs on a NAT router from
> > the inside network ...]
> > 
> > > I can't help but think I'm missing something simple. Then again
> > > does what I'm trying to do make sense?
> > 
> > Just don't DNAT/SNAT packets from the internal network to
> > your public IPs, there is no need for it anyway.
> > 
> > e.g. do something like this before your other DNATs
> > 
> > $IPTABLES -t nat -A PREROUTING -i eth1 -s 192.168.0.0/16 -p tcp -d
> > $HOST_E -j RETURN
> > 
> > Plus, of course, you need to allow access to that IP/port from the
> > internal network in the INPUT chain of the filter table.
> 
> Thanks for the reply. Unfortunately with the above rule, the ssh just
> ends up going to the firewall and not the host. The firewall is
> configured with the IP address of $HOST_E which is where the DNAT
> comes in to change it to it's internal IP.
> 
> It seems what I'm trying to do now is something like:
> 
> internal (workstation)--> external ($HOST_E)--> internal ($HOST_I)
> 
> I could fudge /etc/hosts on machines with the hosts external DNS name
> pointing to its internal IP address, but doing it with the firewall
> seems better.
> 
> e.g 
> host.foo.co.uk has an IP of aaa.aaa.aaa.aaa (accessible from outside
> the office)
> host.foo.bar (internal only DNS name) has an IP of bbb.bbb.bbb.bbb
> 
> I can put 
> 
> bbb.bbb.bbb.bbb foo.co.uk
> 
> in my /etc/hosts file, and then ssh foo.co.uk, works.
> 
> But I do think the firewall is the proper place to do this.


I disagree - DNS is the proper place IMNSHO.  However, configuring
/etc/hosts on individual machines simply doesn't scale; instead, set
up a DNS server for your internal LAN (even run it on the firewall 
itself even), and have it resolve host.foo.bar.uk to bbb.bbb.bbb.bbb 
(the internal ip).

Have a look here for some helpful information:
  http://jengelh.medozas.de/links/iptables/
If you insist on avoiding the DNS solution, then pay attention to
the "Having NAT Issues?" link.

-RW

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 197 bytes --]

Re: Local to Local via firewall

[Thomas Jacob]

On Fri, 2009-07-31 at 17:24 +0100, Andrew Clayton wrote:
> On Fri, 31 Jul 2009 18:06:21 +0200, Thomas Jacob wrote:
> 
> > On Fri, 2009-07-31 at 14:42 +0100, Andrew Clayton wrote:
> > [.. accessing outside IPs on a NAT router from
> > the inside network ...]
> > 
> > > I can't help but think I'm missing something simple. Then again does
> > > what I'm trying to do make sense?
> > 
> > Just don't DNAT/SNAT packets from the internal network to
> > your public IPs, there is no need for it anyway.
> > 
> > e.g. do something like this before your other DNATs
> > 
> > $IPTABLES -t nat -A PREROUTING -i eth1 -s 192.168.0.0/16 -p tcp -d
> > $HOST_E -j RETURN
> > 
> > Plus, of course, you need to allow access to that IP/port from the
> > internal network in the INPUT chain of the filter table.
> 
> Thanks for the reply. Unfortunately with the above rule, the ssh just
> ends up going to the firewall and not the host. The firewall is
> configured with the IP address of $HOST_E which is where the DNAT comes
> in to change it to it's internal IP.

Ah yes, the ssh  server is on a DNATed internal machine, sorry about.

In that case you need to SNAT your request to the local machine as well,
and also keep the original DNAT rule:

So:

$IPTABLES -t nat -A PREROUTING -i eth1 -s 192.168.0.0/16 -p tcp -d
$HOST_E --dport 22 -j DNAT --to-destination $HOST_I

+

$IPTABLES -t nat -A POSTROUTING -o eth1 -s 192.168.0.0/16 -p tcp -d
$HOST_I --dport 22 -j SNAT --to-destination <Internal-Router-IP>


should get you there.

Just tried that on a similar setup and it worked well for me, I can ssh
to myself via the NAT router by contacting the NAT routers public IP ;)

Re: Local to Local via firewall

[Andrew Clayton]

On Fri, 31 Jul 2009 19:49:23 +0200, Thomas Jacob wrote:

> Ah yes, the ssh  server is on a DNATed internal machine, sorry about.
> 
> In that case you need to SNAT your request to the local machine as
> well, and also keep the original DNAT rule:
> 
> So:
> 
> $IPTABLES -t nat -A PREROUTING -i eth1 -s 192.168.0.0/16 -p tcp -d
> $HOST_E --dport 22 -j DNAT --to-destination $HOST_I
> 
> +
> 
> $IPTABLES -t nat -A POSTROUTING -o eth1 -s 192.168.0.0/16 -p tcp -d
> $HOST_I --dport 22 -j SNAT --to-destination <Internal-Router-IP>
> 
> 
> should get you there.
> 
> Just tried that on a similar setup and it worked well for me, I can
> ssh to myself via the NAT router by contacting the NAT routers public
> IP ;)

Thanks again, but after trying this and numerous variations I still
can't make this work, and I've read plenty of other stuff that says to
do what you say, but no cigar :(

It's annoying and I'd like to get it working at the firewall. But for
now I think I'm going to take Robby's advice and have a look at split
views with Bind. This also does seem to be the recommended way to do it.

Still, I must have learnt something from all this! ;)

Cheers,
Andrew

Re: Local to Local via firewall

[/dev/rob0]

On Friday 31 July 2009 15:52:35 Andrew Clayton wrote:
> It's annoying and I'd like to get it working at the firewall. But
> for now I think I'm going to take Robby's advice and have a look
> at split views with Bind. This also does seem to be the recommended
> way to do it. 

I forgot to mention in my reply, but I've found dnsmasq to be a very
good tool for overriding single names in the global DNS. Nothing
against BIND, but it's more difficult to set up and maintain, and
dnsmasq is more flexible for this purpose.
-- 
    Offlist mail to this address is discarded unless
    "/dev/rob0" or "not-spam" is in Subject: header

Re: Local to Local via firewall

[Thomas Jacob]

 
> Thanks again, but after trying this and numerous variations I still
> can't make this work, and I've read plenty of other stuff that says to
> do what you say, but no cigar :(

Well there is no fundamental reason why it shouldn't work along those lines,
most likely your other rules get in the way. I'd start by reducing
the ruleset to the basics and then I'd readd rules till I'd find
the culprit.
 
> It's annoying and I'd like to get it working at the firewall. But for
> now I think I'm going to take Robby's advice and have a look at split
> views with Bind. This also does seem to be the recommended way to do it.

NAT routers always hide some source addresses from at least one machine,
otherwise they wouldn't be NAT routers ;)

But sure, if you have a 1000 people behind your NAT router, NATing local
requests to local services just for the sole reason of not having to use
different names for services from the inside or a split DNS server
might not be such a good idea.

Re: Local to Local via firewall

[Andrew Clayton]

On Sat, 1 Aug 2009 13:52:53 +0200, Thomas Jacob wrote:

> NAT routers always hide some source addresses from at least one
> machine, otherwise they wouldn't be NAT routers ;)
> 
> But sure, if you have a 1000 people behind your NAT router, NATing
> local requests to local services just for the sole reason of not
> having to use different names for services from the inside or a split
> DNS server might not be such a good idea.

Thanks for the help guys.

I've got "views" set up in BIND on one of our internal DNS servers
(which is also our secondary nameserver for all our domains).

Seem to be working a treat.

host.foo.bar will return a different IP address depending on if
the query come in externally or internally.
  
Cheers,
Andrew

Re: Local to Local via firewall

[/dev/rob0]

On Friday 31 July 2009 11:24:19 Andrew Clayton wrote:
> On Fri, 31 Jul 2009 18:06:21 +0200, Thomas Jacob wrote:
> > On Fri, 2009-07-31 at 14:42 +0100, Andrew Clayton wrote:
> > [.. accessing outside IPs on a NAT router from
> > the inside network ...]

> But I do think the firewall is the proper place to do this.

To elaborate a bit on *why* Robby is right in his not-so-humble
opinion: the SNAT+DNAT solution makes your logs meaningless. There's
really no way to tell who's doing what, and from where.

I've seen cases in which people put too many eggs in a single DNS RR
basket ... like http://foo.example.com/ being SNAT'ed to LAN host
web.example.lan, and smtp:foo.example.com being SNAT'ed to a different
LAN host, mail.example.lan.

In a case like that, the SNAT+DNAT solution is the only one that will
keep foo.example.com working for clients behind the NAT. But there,
your real fix would be to use more names ... www.example.com and
mail.example.com in the above. If your DNS provider is charging you
extra for adding more names, find a reasonable DNS provider!
-- 
    Offlist mail to this address is discarded unless
    "/dev/rob0" or "not-spam" is in Subject: header