DNATing back to the same network

DNATing back to the same network

[danci]

Hi!

I have a firewall with a number of DNAT rules for various ports/hosts. It 
would be good if local users could use the same DNAT's. However, as it 
seems this doesn't work.

My firewall has a public IP. Some ports on this IP are DNATed to different 
hosts on the local network. DNAT works for users that connect from the 
internet.

However, when a local users tries to connect to the public IP and DNATed 
port, the connection fails. Which is basically logical as the server 
receives a packet with the source IP of the actual user and it answeres 
directly to that IP.

Is it possible to change netfilter behaviour? Any other work-around for 
that?

Thanks, Danilo

Re: DNATing back to the same network

[Charlie Brady]

On Thu, 13 Jan 2005 danci@agenda.si wrote:

> I have a firewall with a number of DNAT rules for various ports/hosts. It 
> would be good if local users could use the same DNAT's. However, as it 
> seems this doesn't work.
> 
> My firewall has a public IP. Some ports on this IP are DNATed to different 
> hosts on the local network. DNAT works for users that connect from the 
> internet.
> 
> However, when a local users tries to connect to the public IP and DNATed 
> port, the connection fails. Which is basically logical as the server 
> receives a packet with the source IP of the actual user and it answeres 
> directly to that IP.
> 
> Is it possible to change netfilter behaviour? Any other work-around for 
> that?

Set up split horizon DNS so that the internal clients go direct to the 
internal IP, rather than to the public IP.

---
Charlie

Re: DNATing back to the same network

[Samuel Jean]

On Thu, January 13, 2005 9:42 am, danci@agenda.si said:
> Hi!

Hi Danilo!

> [...]
> Is it possible to change netfilter behaviour? Any other work-around for
> that?

http://www.netfilter.org/documentation/HOWTO/NAT-HOWTO-10.html

>
> Thanks, Danilo

HTH,

Samuel

DNATing back to the same network

[Don Hughes]

 
> Message: 1
> Date: Thu, 13 Jan 2005 15:42:33 +0100 (CET)
> From: danci@agenda.si
> Subject: DNATing back to the same network
> To: netfilter@lists.netfilter.org
> Message-ID: <Pine.LNX.4.58.0501131538030.16403@desktop.agenda.si>
> Content-Type: TEXT/PLAIN; charset=US-ASCII
> 
> Hi!
> 
> I have a firewall with a number of DNAT rules for various ports/hosts.
> It would be good if local users could use the same DNAT's. However, as
> it seems this doesn't work.
> 
> My firewall has a public IP. Some ports on this IP are DNATed to
> different hosts on the local network. DNAT works for users that
> connect from the internet.
> 
> However, when a local users tries to connect to the public IP and
> DNATed port, the connection fails. Which is basically logical as the
> server receives a packet with the source IP of the actual user and it
> answeres directly to that IP.
> 
> Is it possible to change netfilter behaviour? Any other work-around
> for that?
> 

I have a POSTROUTING rule for any internal traffic to SNAT it so 
that it returns back to the router instead of directly to the 
user.




-- 
..don

dhughes@microtechniques.com
White Plains, NY

Re: DNATing back to the same network

[danci]

On Thu, 13 Jan 2005, Don Hughes wrote:

> I have a POSTROUTING rule for any internal traffic to SNAT it so 
> that it returns back to the router instead of directly to the 
> user.

That's exactly what I did a few minutes ago! :)

Are there any other implications this SNAT rule could add?

Thanks, Danilo

Re: DNATing back to the same network

[Charlie Brady]

On Thu, 13 Jan 2005 danci@agenda.si wrote:

> On Thu, 13 Jan 2005, Don Hughes wrote:
> 
> > I have a POSTROUTING rule for any internal traffic to SNAT it so 
> > that it returns back to the router instead of directly to the 
> > user.
> 
> That's exactly what I did a few minutes ago! :)
> 
> Are there any other implications this SNAT rule could add?

Yes, your router will be blamed for any attacks on the server which 
originate inside the LAN. You likely won't have any logs to refute such 
claims.

---
Charlie

Re: DNATing back to the same network

[Ian! D. Allen]

>However, when a local users tries to connect to the public IP and DNATed
>port, the connection fails. Which is basically logical as the server
>receives a packet with the source IP of the actual user and it answeres
>directly to that IP.  Is it possible to change netfilter behaviour? Any
>other work-around for that?

As Samuel noted, that is described here:

    http://www.netfilter.org/documentation/HOWTO/NAT-HOWTO-10.html

and I elaborate on it here:

    http://idallen.com/dnat.txt

-- 
-IAN!  Ian! D. Allen   Ottawa, Ontario, Canada
       EMail: idallen@idallen.ca   WWW: http://www.idallen.com/
       College professor (Linux) via: http://teaching.idallen.com/
       Support free and open public digital rights:  http://eff.org/

Re: DNATing back to the same network

[Mohammad Khan]

On Thu, 2005-01-13 at 10:56, Samuel Jean wrote:
> On Thu, January 13, 2005 9:42 am, danci@agenda.si said:
> > Hi!
> 
> Hi Danilo!
> 
> > [...]
> > Is it possible to change netfilter behaviour? Any other work-around for
> > that?
> 
> http://www.netfilter.org/documentation/HOWTO/NAT-HOWTO-10.html
> 
> >
> > Thanks, Danilo
> 
> HTH,
> 
> Samuel
> 

I had the same issue.
Thanks for posting the documentation link.

MOhammad

-- 
"Mad cow? You'd be mad too, if someone was trying to eat you."