Re: Maybe a Newbie question about SNAT/DNAT

["Jörg Harmuth" <harmuth@mnemon.de>]

Hi Melim,

melim schrieb:
> 
> I have a valid IP in a interface eth2 and a internal net ip on eth0, I'm
> using some well documented rules to redirect port requisitions to another
> internal server.
> 
> iptables -t nat -A PREROUTING -p tcp --dport 80 -d 200.180.X.X -j
> DNAT --to-destination 192.168.200.251
> iptables -t nat -A POSTROUTING -p tcp --sport 80 -s 192.168.200.251 -j
> SNAT --to-source 200.180.X.X

...

> On the webserver I have a default gateway defined to another router, but
> even removing it, won't work.
> Only works when I defined the default GW to my router machine, but I don't
> want to do this.

So you DNAT HTTP requests to 192.168.200.251 and you SNAT the reponses
to 200.180.X.X. Ok so far. Some tcpdump would be nice, but I think you
can solve this with the following rule:

iptables -t nat -I POSTROUTING -p tcp -o eth0 --dport 80 \
         -j SNAT --to-source 192.168.200.254

This assumes that eth0 on your router is 192.168.200.254. I think this
happens:

Incoming request from e.g. 1.1.1.1. DNAT to 192.168.200.251. This packet
arrives at the web server:

dst: 192.168.200.251
src: 1.1.1.1 !!

As 1.1.1.1 is not known to the web server he sends it to his default
gateway, which is _not_ the router, so the packets vanish. tcpdump a bit
and probably you will see exactly this.

HTH and have a nice time,

Joerg