From mboxrd@z Thu Jan 1 00:00:00 1970 From: Rob Sterenborg Subject: RE: PPTP+NAT+MASQ anyone? Date: Mon, 9 Dec 2002 12:57:09 +0100 Sender: netfilter-admin@lists.netfilter.org Message-ID: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C29F7A.1A3B0FE0" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: 'Roy Sigurd Karlsbakk' , 'Netfilter mailinglist' This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. ------_=_NextPart_001_01C29F7A.1A3B0FE0 Content-Type: text/plain > I've kept trying now. many times, to do NAT+MASQ+PPTP, but as > soon as I > compile 2.4.18 (the only one I've managed to patch-o-matic) > and boot it, it > refuses to -j MASQUERADE. (invalid argument). Are anyone running this? Yup, on my test-box : 2.4.20-rc1 (still, but it's doing nothing at the moment). I had no problems patching it however. Rob ------_=_NextPart_001_01C29F7A.1A3B0FE0 Content-Type: text/html RE: PPTP+NAT+MASQ anyone?

> I've kept trying now. many times, to do NAT+MASQ+PPTP, but as
> soon as I
> compile 2.4.18 (the only one I've managed to patch-o-matic)
> and boot it, it
> refuses to -j MASQUERADE. (invalid argument). Are anyone running this?

Yup, on my test-box : 2.4.20-rc1 (still, but it's doing nothing at the moment).
I had no problems patching it however.


Rob

------_=_NextPart_001_01C29F7A.1A3B0FE0-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: bernard Subject: hostname forwarding Date: Wed, 11 Dec 2002 15:05:49 +0100 Sender: netfilter-admin@lists.netfilter.org Message-ID: References: Mime-Version: 1.0 Return-path: In-Reply-To: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii"; format="flowed" Content-Transfer-Encoding: 7bit To: netfilter@lists.netfilter.org I'm using iptables to redirect external requests depending on their port/protocol like this : hostname A:80 -> public ip -> iptables -> 192.168.1.1:80 hostname B:80 -> public ip -> iptables -> 192.168.1.1:80 It works pretty well, thanks to iptables :-) Now I want to redirect on a hostname basis on different private ip's like this : hostname A:80 -> public ip -> iptables -> 192.168.1.1:80 hostname B:80 -> public ip -> iptables -> 192.168.1.2:80 Does anyone know a solution ? Thanks for your help. Bernard From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Rob Sterenborg" Subject: RE: hostname forwarding Date: Wed, 11 Dec 2002 16:43:50 +0100 Sender: netfilter-admin@lists.netfilter.org Message-ID: References: Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: 'bernard' , netfilter@lists.netfilter.org > Now I want to redirect on a hostname basis on different private ip's > like this : > > hostname A:80 -> public ip -> iptables -> 192.168.1.1:80 > hostname B:80 -> public ip -> iptables -> 192.168.1.2:80 > > Does anyone know a solution ? Iptables will only forward (resolved) IP adresses (and/or ports). If Host-A has the same IP address as Host-B, then packets will be forwarded to one and the same internet IP address. You could accept http traffic on, let's say, port 81 and redirect traffic for Host-B:81 to 192.168.1.2:80, but I don't think that's what you want : people would have to type http://Host-B:81 to enter the site. Rob From mboxrd@z Thu Jan 1 00:00:00 1970 From: Patrick Maartense Subject: Re: hostname forwarding Date: Wed, 11 Dec 2002 16:06:53 +0100 (CET) Sender: netfilter-admin@lists.netfilter.org Message-ID: References: Mime-Version: 1.0 Return-path: In-Reply-To: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: TEXT/PLAIN; charset="us-ascii" Content-Transfer-Encoding: 7bit To: bernard Cc: netfilter@lists.netfilter.org this is not possible using ipotables Apache however can very well handle this .. On Wed, 11 Dec 2002, bernard wrote: > I'm using iptables to redirect external requests depending on their > port/protocol like this : > > hostname A:80 -> public ip -> iptables -> 192.168.1.1:80 > hostname B:80 -> public ip -> iptables -> 192.168.1.1:80 > > It works pretty well, thanks to iptables :-) > > Now I want to redirect on a hostname basis on different private ip's > like this : > > hostname A:80 -> public ip -> iptables -> 192.168.1.1:80 > hostname B:80 -> public ip -> iptables -> 192.168.1.2:80 > > Does anyone know a solution ? > > Thanks for your help. > > Bernard > -- --- Kind Regards Patrick Maartense (using Pine on a Text Console) From mboxrd@z Thu Jan 1 00:00:00 1970 From: Raymond Leach Subject: Re: hostname forwarding Date: 12 Dec 2002 07:36:10 +0200 Sender: netfilter-admin@lists.netfilter.org Message-ID: <1039671369.4125.12.camel@rayw.knowledgefactory.co.za> References: Reply-To: raymondl@knowledgefactory.co.za Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-aHYyzQbX48qLjKl+yRY2" Return-path: In-Reply-To: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: Patrick Maartense Cc: bernard , Netfilter Mailing List --=-aHYyzQbX48qLjKl+yRY2 Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On Wed, 2002-12-11 at 17:06, Patrick Maartense wrote: > this is not possible using ipotables >=20 Ummm, what is the -s parameter for then? iptables -t nat -A PREROUTING -p tcp -s --dport 80 -j REDIRECT --to-destination 192.168.1.1:80 iptables -t nat -A PREROUTING -p tcp -s --dport 80 -j REDIRECT --to-destination 192.168.1.2:80 Or am I missing something? Ray > Apache however can very well handle this .. >=20 >=20 > On Wed, 11 Dec 2002, bernard wrote: >=20 > > I'm using iptables to redirect external requests depending on their=20 > > port/protocol like this : > >=20 > > hostname A:80 -> public ip -> iptables -> 192.168.1.1:80 > > hostname B:80 -> public ip -> iptables -> 192.168.1.1:80 > >=20 > > It works pretty well, thanks to iptables :-) > >=20 > > Now I want to redirect on a hostname basis on different private ip's=20 > > like this : > >=20 > > hostname A:80 -> public ip -> iptables -> 192.168.1.1:80 > > hostname B:80 -> public ip -> iptables -> 192.168.1.2:80 > >=20 > > Does anyone know a solution ? > >=20 > > Thanks for your help. > >=20 > > Bernard > >=20 --=20 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ( Raymond Leach ) ) Knowledge Factory ( ( ) ) Tel: +27 11 445 8100 ( ( Fax: +27 11 445 8101 ) ) ( ( http://www.knowledgefactory.co.za/ ) ) http://www.saptg.co.za/ ( ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ o o o o .--. .--. | o_o| |o_o | | \_:| |:_/ | / / \\ // \ \ ( | |) (| | ) /`\_ _/'\ /'\_ _/`\ \___)=3D(___/ \___)=3D(___/ --=-aHYyzQbX48qLjKl+yRY2 Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) iD8DBQA9+CBJh1fuR/Bv+ygRAqg3AJsHV20whXMMp2ZTGU9yj2qv6gVbIACfWhRJ DofJTC9JynNR1QDvPvmBI1Q= =Lgoh -----END PGP SIGNATURE----- --=-aHYyzQbX48qLjKl+yRY2-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Blizzards Subject: Re: hostname forwarding Date: Thu, 12 Dec 2002 08:16:10 +0100 Sender: netfilter-admin@lists.netfilter.org Message-ID: <3DF837BA.5000908@libero.it> References: <1039671369.4125.12.camel@rayw.knowledgefactory.co.za> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii"; format="flowed" To: raymondl@knowledgefactory.co.za Cc: Patrick Maartense , bernard , Netfilter Mailing List The host A and Host B share the same ip address. In this case -s is no useful because resolving host a and host b return the same address, and the 1st match win. You can use APACHE name virtual host to handle this correctly. G. >> >> >> >Ummm, what is the -s parameter for then? >iptables -t nat -A PREROUTING -p tcp -s --dport 80 -j >REDIRECT --to-destination 192.168.1.1:80 >iptables -t nat -A PREROUTING -p tcp -s --dport 80 -j >REDIRECT --to-destination 192.168.1.2:80 > >Or am I missing something? > >Ray > > From mboxrd@z Thu Jan 1 00:00:00 1970 From: Raymond Leach Subject: Re: hostname forwarding Date: 12 Dec 2002 09:13:34 +0200 Sender: netfilter-admin@lists.netfilter.org Message-ID: <1039677214.4098.24.camel@rayw.knowledgefactory.co.za> References: <1039671369.4125.12.camel@rayw.knowledgefactory.co.za> <3DF837BA.5000908@libero.it> Reply-To: raymondl@knowledgefactory.co.za Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-G3WD9mL4tdca8WG+4lAP" Return-path: In-Reply-To: <3DF837BA.5000908@libero.it> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: Blizzards Cc: Patrick Maartense , bernard , Netfilter Mailing List --=-G3WD9mL4tdca8WG+4lAP Content-Type: text/plain Content-Transfer-Encoding: quoted-printable OK, that makes sense... On Thu, 2002-12-12 at 09:16, Blizzards wrote: > The host A and Host B share the same ip address. > In this case -s is no useful because resolving host a and host b return=20 > the same address, and the 1st match win. > You can use APACHE name virtual host to handle this correctly. >=20 > G. >=20 > >> > >> =20 > >> > >Ummm, what is the -s parameter for then? > >iptables -t nat -A PREROUTING -p tcp -s --dport 80 -j > >REDIRECT --to-destination 192.168.1.1:80 > >iptables -t nat -A PREROUTING -p tcp -s --dport 80 -j > >REDIRECT --to-destination 192.168.1.2:80 > > > >Or am I missing something? > > > >Ray > > =20 > > --=20 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ( Raymond Leach ) ) Knowledge Factory ( ( ) ) Tel: +27 11 445 8100 ( ( Fax: +27 11 445 8101 ) ) ( ( http://www.knowledgefactory.co.za/ ) ) http://www.saptg.co.za/ ( ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ o o o o .--. .--. | o_o| |o_o | | \_:| |:_/ | / / \\ // \ \ ( | |) (| | ) /`\_ _/'\ /'\_ _/`\ \___)=3D(___/ \___)=3D(___/ --=-G3WD9mL4tdca8WG+4lAP Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) iD8DBQA9+Dceh1fuR/Bv+ygRAnPGAKCTdUIIkzPMJrIjiYJWtyrD5xkFDwCfVNVu 3cM9QXxo1YhRtXq/9HHmaBg= =Tj22 -----END PGP SIGNATURE----- --=-G3WD9mL4tdca8WG+4lAP-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: bernard Subject: Re: hostname forwarding Date: Thu, 12 Dec 2002 13:20:41 +0100 Sender: netfilter-admin@lists.netfilter.org Message-ID: References: Mime-Version: 1.0 Return-path: In-Reply-To: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii"; format="flowed" Content-Transfer-Encoding: 7bit To: netfilter@lists.netfilter.org Thank again for your valuable help. So apache can take http requests to do that but what's about the other protocols ? It seems that squid can do a transparent proxy for some of them. Do I need to use a specific solutions for each different protocol I want to set and what solution to use for the most common (telnet, pop, imap, ftp, ...) ? Bernard >this is not possible using ipotables > >Apache however can very well handle this .. > > >On Wed, 11 Dec 2002, bernard wrote: > >> I'm using iptables to redirect external requests depending on their >> port/protocol like this : >> >> hostname A:80 -> public ip -> iptables -> 192.168.1.1:80 >> hostname B:80 -> public ip -> iptables -> 192.168.1.1:80 >> >> It works pretty well, thanks to iptables :-) >> >> Now I want to redirect on a hostname basis on different private ip's >> like this : >> >> hostname A:80 -> public ip -> iptables -> 192.168.1.1:80 >> hostname B:80 -> public ip -> iptables -> 192.168.1.2:80 >> >> Does anyone know a solution ? >> >> Thanks for your help. >> >> Bernard >> > >-- >--- >Kind Regards >Patrick Maartense (using Pine on a Text Console)