SNAT kills local stuff?

SNAT kills local stuff?

[David Busby]

List,
    Perhaps I'm missing something, when I enable SNAT it makes it so I can't
resolve names anymore on my machine or make outbound connections it seems.

My Setup:
[ Local (10./24) ] <-> [ netfilter ] <-> [ Internet ]

So I setup iptables like this:
root@repono:/etc# iptables -t filter -L
Chain INPUT (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere           state
RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere           tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere           tcp dpt:domain
ACCEPT     udp  --  anywhere             anywhere           udp dpt:domain
LOG        all  --  anywhere             anywhere           LOG level
warning

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
root@repono:/etc

Everything is OK, Lan can resolve names and such.

Now I add:
iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to $EXTERNAL_IP
And it all works, this command:
iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -j SNAT --to $EXTERNAL_IP
Doesn't work. The LAN is fine, but the localbox cannot connect out.
What is so different about those two commands?

David Busby
Systems Engineer
busby@pnts.com

Re: SNAT kills local stuff?

[Willi Mann]

Please tell us what you mean by "connect out". Do you mean connections 
to any other host or do you mean connections to hosts outside your LAN?

My guess is that the problem occurs because all packets go through the 
POSTROUTING chain, not only packets that will go to the Internet. That's 
why most examples use (only) -o.

I'd suggest to analyze your IP-Traffic with ethereal.

WM

RE: SNAT kills local stuff?

[George Vieira]

"iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -j SNAT --to $EXTERNAL_IP"
Probably because you ignore the -o eth1 on the second line.

Thanks,
____________________________________________
George Vieira
Systems Manager
georgev@citadelcomputer.com.au

Citadel Computer Systems Pty Ltd
http://www.citadelcomputer.com.au

Phone   : +61 2 9955 2644
HelpDesk: +61 2 9955 2698