snat and dnat

snat and dnat

[Philippe Dhont (Sea-ro)]

Hi, 

I am a beginner with NAT and maybe you could just help me starting with the
following so i can find the rest myself.
i have an eth0 and eth1 
eth0: 10.51.51.51
eth1: 10.165.254.220
on the eth0 side i have a client 10.51.13.13 who needs to ping to a client
10.165.1.60 
so that's from one side to the other side.
is that SNAT or DNAT ?
and how do i write this in rules ?

thnx!


	--tronstr@axsomic--

snat and dnat

[Philippe Dhont (Sea-ro)]

hi,

i had some problems testing the nat thing but now it seems to work without
any rule in snat 
and i can ping from network A to network B in other ranges, but the
ip_forwarding is doing all the work.
is this normal ? 

	--tronstr@csomic--

Re: snat and dnat

[Ralf Spenneberg]

Am Fre, 2003-04-04 um 09.59 schrieb Philippe Dhont (Sea-ro):
> Hi, 
> 
> I am a beginner with NAT and maybe you could just help me starting with the
> following so i can find the rest myself.
> i have an eth0 and eth1 
> eth0: 10.51.51.51
> eth1: 10.165.254.220
> on the eth0 side i have a client 10.51.13.13 who needs to ping to a client
> 10.165.1.60 
> so that's from one side to the other side.
> is that SNAT or DNAT ?
Well, in the beginning it is just routing. Therefore, if both clients
use the machine in between as a default gateway, it should work out of
the box.

If you want to hide the fact, that actually client1 pings client2 or
client2 does not use the FW as default gateway you have to use SNAT:
iptables -t nat -A POSTROUTING -o eth1 -s 10.51.0.0/16 -j SNAT --to
10.165.254.220

It would be DNAT, if client1 pings your firewall and this ping is
answered by client2 in reality.

cheers,

Ralf
-- 
Ralf Spenneberg
RHCE, RHCX

IPsec/PPTP Kernels for Red Hat Linux:  
http://www.spenneberg.com/.net/.org/.de
Honeynet Project Mirror:                http://honeynet.spenneberg.org
Snort Mirror:                           http://snort.spenneberg.org

Re: snat and dnat

[Ralf Spenneberg]

Am Fre, 2003-04-04 um 10.24 schrieb Philippe Dhont (Sea-ro):
> hi,
> 
> i had some problems testing the nat thing but now it seems to work without
> any rule in snat 
> and i can ping from network A to network B in other ranges, but the
> ip_forwarding is doing all the work.
> is this normal ?
Yes it is. 

Ralf
 
> 
> 	--tronstr@csomic--
> 
> 
-- 
Ralf Spenneberg
RHCE, RHCX

IPsec/PPTP Kernels for Red Hat Linux:  
http://www.spenneberg.com/.net/.org/.de
Honeynet Project Mirror:                http://honeynet.spenneberg.org
Snort Mirror:                           http://snort.spenneberg.org

SNAT and DNAT

[julien WICQUART]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

i have a special situation.


(INTERNET) ===== 210.210.210.210/eth0|firewall|10.0.0.1/eth1 ===== 10.0.0.2|server|


I want to DNAT a port of my firewall on a server inside:
$IPTABLES -t nat -A PREROUTING -i eth0 -d 210.210.210.210 -p tcp --dport 200 -j DNAT
- --to-destination 10.0.0.2:200

but the server inside only accept packets from the IP of the inside interface of the firewall :
10.0.0.1 so i need that the source IP address of the packet sent by someone(x.x.x.x) on the internet
change in 10.0.0.1.

I try the SNAT, the MASQUERADE:
$IPTABLES -t nat -A POSTROUTING -o eth1 -s x.x.x.x -p tcp --dport 20000 -j SNAT --to 10.0.0.1
or
$IPTABLES -t nat -A POSTROUTING -o eth1 -s x.x.x.x -j MASQUERADE
it don't work.


Anyone know how to make this, DNAT and SNAT simultaneously.

Thanks.

- --

- --
Julien
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)

iD8DBQFCbk2syavHQ2fnGwsRAugxAJ9uDT0Vnsai53XB0o7aMdghpz9ZEACeIkI+
rNvI7zZ8iaJcsNRnMCcjkvI=
=jaWr
-----END PGP SIGNATURE-----

Re: SNAT and DNAT

[Taylor, Grant]

> Hi,
> 
> i have a special situation.
> 
> (INTERNET) ===== 210.210.210.210/eth0|firewall|10.0.0.1/eth1 ===== 10.0.0.2|server|
> 
> I want to DNAT a port of my firewall on a server inside:
> $IPTABLES -t nat -A PREROUTING -i eth0 -d 210.210.210.210 -p tcp --dport 200 -j DNAT
> - --to-destination 10.0.0.2:200
> 
> but the server inside only accept packets from the IP of the inside interface of the firewall :
> 10.0.0.1 so i need that the source IP address of the packet sent by someone(x.x.x.x) on the internet
> change in 10.0.0.1.
> 
> I try the SNAT, the MASQUERADE:
> $IPTABLES -t nat -A POSTROUTING -o eth1 -s x.x.x.x -p tcp --dport 20000 -j SNAT --to 10.0.0.1
> or
> $IPTABLES -t nat -A POSTROUTING -o eth1 -s x.x.x.x -j MASQUERADE
> it don't work.

You are DNATing to the destination port of 200 where as you are later looking for traffic headed to 20000 and thus will never match the traffic that you DNATed.

Another point (IMHO) that you might want to consider is that if you have any client systems on the inside of the firewall that will be trying to connect to the x.x.x.x server they will never get return traffic as it will be SNATed to the firewalls internal IP.  I would recommend that you add an additional "-d 10.0.0.2" match to your rule to make sure that you don't erroneously SNAT traffic that should be going else where.



Grant. . . .