Re: Forward internal packets as though they're external

[Jon Heese <netfilter@jonheese.com>]

Ah, I was so caught up in iptables, I wasn't even thinking about 
routing.  Just tried adding a route on Castor to Webster through Router, 
and it works.  Thanks for all the help, Rob and Edvin.

Regards,
Jon Heese

Seferovic Edvin wrote:
> Why don't you tell Castor all packages to Webster over the router? Adding an
> extra route shouldn't be a problem, and the connection tracking would work
> in this way... this way you will need an SNAT over the router to Webster...
> 
> Regards,
> 
> Edvin
> 
> -----Original Message-----
> From: netfilter-bounces@lists.netfilter.org
> [mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of Jon Heese
> Sent: Freitag, 28. Oktober 2005 01:32
> To: netfilter@lists.netfilter.org
> Subject: Re: Forward internal packets as though they're external
> 
> Okay, so I assume you're saying I should try:
> 
> iptables -vt nat -A POSTROUTING -p tcp --dport 6969 -s 192.168.0.0/24 \
>      -d 192.168.0.100 -j SNAT --to 65.9.134.4
> 
> Tried that and got no errors running the firewall/nat script, but still 
> no go connecting to 65.9.134.4:6969 from 192.168.0.101.
> 
> I thought about the scenario, and I think I see why it's not working:
> 
> A SYN packet from Webster addressed to 65.9.134.4:6969 goes to the 
> router, and the router sends it to Castor because of its DNAT chain. 
> Castor gets this packet with a source address of Webster 
> (192.168.0.101), and sends back an ACK directly to Webster across the 
> local segment, so the packet never has to even cross the router, and 
> therefore the SNAT rule I added above is never met.  Webster sees the 
> ACK from Castor and throws it away, since it never knowingly tried to 
> connect to Castor.
> 
> So, it seems there is no simple way to do what I want to do here with 
> iptables.  I suppose I'll have to figure out a clever DNS scheme to take 
> care of this.
> 
> If anyone has any ideas, no matter how complicated, I'd certainly be 
> interested in hearing them.
> 
> Regards,
> Jon Heese
> 
> /dev/rob0 wrote:
> 
>>On Thursday 2005-October-27 09:38, I wrote:
>>
>>
>>>Perhaps you need a SNAT rule in POSTROUTING:
>>
>>
>>That's probably correct.
>>
>>
>>
>>>iptables -vt nat -A PREROUTING -p tcp --dport 6969 -s 192.168.0.0/24
>>>\ -d 192.168.0.100 -j SNAT --to 65.9.134.4
>>
>>
>>The example, obviously, is not correct. Copy/paste/PEBKAC error.
> 
> 
>