NATed and direct connection to one server

NATed and direct connection to one server

[Ben Goedeke]

Hey everybody,

I just took over administering a LAN at a university site and I have to 
move an entire subnet from private to regular IPs. Up until now the only 
outside access to this net was a pop and an smtp server both of which 
the users accessed through the firewall's _IP_ address (there was no DNS 
entry). There were two NAT rules that forwarded the ports to the real 
servers.

To make the move as painless as possible for the users I want to keep 
the DNAT rules for a while (and point them to the new IP of the mail 
servers). I also added DNS entries for the real IPs of the mail servers. 
In the long run I want to drop NAT altogether but for now the mail 
servers should be reachable via both the firewall and their own 
addresses. Because I doubt everybody will immediately change their mail 
client'ss settings.

Now for my question: Do I need to add an SNAT rule in POSTROUTING to 
handle responses from the mail servers or is it enough to have the DNAT 
rules in PREROUTING? And if I indeed need an SNAT rule how can I 
possibly distinguish packets that belong to connections that were DNATed 
when they came in and those that weren't and had the right destination 
IP all along?

I feel like I'm making a simple thing very complicated here... but I 
only have limited experience with iptables. So any help is greatly 
appreciated.

Thanks,
Ben

Re: NATed and direct connection to one server

[Antony Stone]

On Tuesday 17 February 2004 7:29 pm, Ben Goedeke wrote:

> To make the move as painless as possible for the users I want to keep
> the DNAT rules for a while (and point them to the new IP of the mail
> servers).
>
> Now for my question: Do I need to add an SNAT rule in POSTROUTING to

No.

> handle responses from the mail servers or is it enough to have the DNAT
> rules in PREROUTING?

Yes.

> And if I indeed need an SNAT rule how can I
> possibly distinguish packets that belong to connections that were DNATed
> when they came in and those that weren't and had the right destination
> IP all along?

No problem (see above).

Regards,

Antony.

-- 
What makes you think I know what I'm talking about?
I just have more O'Reilly books than most people.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: NATed and direct connection to one server

[Ben Goedeke]

Ok, thanks Antony.

It's been bugging me for a few days now cause I just couldn't imagine 
the software being "intelligent" enough to make this so easy.

Re: NATed and direct connection to one server

[Antony Stone]

On Tuesday 17 February 2004 8:33 pm, Ben Goedeke wrote:

> Ok, thanks Antony.
>
> It's been bugging me for a few days now cause I just couldn't imagine
> the software being "intelligent" enough to make this so easy.

netfilter remembers the packets which it translates on the way out (source + 
destination IP address, source + destination port (if TCP or UDP)), and looks 
for packets coming back which match the other way round (source vs. 
destination).

When it sees such matching packets, it knows they must be replies to 
previously translated ones, so it automagically applies the reverse 
translation on the way back in.   Any packets which don't match ones 
previously sent, don't get automagically translated.

Antony.

-- 
How I want a drink, alcoholic of course, after the heavy chapters involving 
quantum mechanics.

 - 3.14159265358979

                                                     Please reply to the list;
                                                           please don't CC me.