Re: DNS and NAT

[/dev/rob0 <rob0@gmx.co.uk>]

Please don't top-post. Thank you.

Suzana Lojic-Skoric wrote:
> OK, thanks I was not sure what is the proper behavior regarding
> iptables and DNS.

The usual situation is that clients are NAT'ed out, like what you're 
describing.

> If answer is not translated then how do I get DNS to work with two way NAT?

What does not work? Two-way NAT is fine. You go on to say you're not 
really talking about two-way NAT:

> My internal network does not understand any of the ip addresses that 
> belong to outside. So if the request for a page that is sent from 
> internal network comes back from outside with an answer (ip address) 
> that is not getting translated then I can't resolve the page since my 
> internal network doesn't understand it and can't route to it.

Clients need to have a default route through the NAT gateway, which does 
SNAT or MASQUERADE. How is it two-way if the clients can't route out?

> Is there a way around this problem? How do I get DNS to work in the type 
> of environment I described?

If you don't want to allow NAT clients out for some reason, you might 
check into running proxy servers, such as squid for HTTP/FTP. Only the 
services you are proxying can be used by internal clients. SOCKS proxy 
servers can handle multiple protocols, but I don't know anything more 
about it than just that fact.

Proxy servers are a good choice in some circumstances; you maintain 
maximum control over what clients can and cannot do (unless users have 
shell access to the proxy server, perhaps.) But proxying is far more 
resource-intensive than NAT.
-- 
     mail to this address is discarded unless "/dev/rob0"
     or "not-spam" is in Subject: header