SNAT from multiple interfaces with the same IP?

SNAT from multiple interfaces with the same IP?

[Carl-Daniel Hailfinger]

Hi,

some time ago, I read that netfilter is unable to perform SNAT
for identical ranges on different interfaces.

Scenario:

eth0: 192.168.0.1/16
eth1: 192.168.0.1/16
eth2: 10.2.0.1/8

iptables -t nat -A POSTROUTING -i eth0 -s 192.168.0.0/16 -j SNAT --to-source 10.0.0.0-10.0.255.255
iptables -t nat -A POSTROUTING -i eth1 -s 192.168.0.0/16 -j SNAT --to-source 10.1.0.0-10.1.255.255

Will that work or is connection tracking unable to differentiate
between the 192.168/16 subnets on eth0 and eth1? My problem is
that although the ranges on eth0 and eth1 are sparsely populated,
some IPs exist in both networks. Communication between the networks
on eth0 and eth1 is not necessary, I just want them to be able to
communicate with the outside (on eth2).

If this is not possible, is there a patch in POM or something else
with which I can achieve my goal with only one machine.


Regards,
Carl-Daniel

Re: SNAT from multiple interfaces with the same IP?

[Patrick McHardy]

Carl-Daniel Hailfinger wrote:
> Hi,
> 
> some time ago, I read that netfilter is unable to perform SNAT
> for identical ranges on different interfaces.
> 
> Scenario:
> 
> eth0: 192.168.0.1/16
> eth1: 192.168.0.1/16
> eth2: 10.2.0.1/8
> 
> iptables -t nat -A POSTROUTING -i eth0 -s 192.168.0.0/16 -j SNAT 
> --to-source 10.0.0.0-10.0.255.255
> iptables -t nat -A POSTROUTING -i eth1 -s 192.168.0.0/16 -j SNAT 
> --to-source 10.1.0.0-10.1.255.255
> 
> Will that work or is connection tracking unable to differentiate
> between the 192.168/16 subnets on eth0 and eth1? My problem is
> that although the ranges on eth0 and eth1 are sparsely populated,
> some IPs exist in both networks. Communication between the networks
> on eth0 and eth1 is not necessary, I just want them to be able to
> communicate with the outside (on eth2).

I don't see why it wouldn't work, but you can't use -i in POSTROUTING
directly, you need to mark the packets or just SNAT unconditionally.

Re: SNAT from multiple interfaces with the same IP?

[Herve Eychenne]

On Sun, Dec 04, 2005 at 04:31:59PM +0100, Patrick McHardy wrote:

> I don't see why it wouldn't work, but you can't use -i in POSTROUTING
> directly,

BTW, I've always wondered why exactly...

> you need to mark the packets or just SNAT unconditionally.

 Herve

-- 
 _
(°=  Hervé Eychenne
//)
v_/_ WallFire project:  http://www.wallfire.org/

Re: SNAT from multiple interfaces with the same IP?

[Patrick McHardy]

Herve Eychenne wrote:
> On Sun, Dec 04, 2005 at 04:31:59PM +0100, Patrick McHardy wrote:
> 
> 
>>I don't see why it wouldn't work, but you can't use -i in POSTROUTING
>>directly,
> 
> 
> BTW, I've always wondered why exactly...

Two reasons:

- The incoming interface is not known anymore in POST_ROUTING
- Locally generated packets don't even have an incoming interface

Re: SNAT from multiple interfaces with the same IP?

[Herve Eychenne]

On Sun, Dec 04, 2005 at 05:02:09PM +0100, Patrick McHardy wrote:

> Herve Eychenne wrote:
> >On Sun, Dec 04, 2005 at 04:31:59PM +0100, Patrick McHardy wrote:
> >
> >
> >>I don't see why it wouldn't work, but you can't use -i in POSTROUTING
> >>directly,
> >
> >
> >BTW, I've always wondered why exactly...

> Two reasons:

> - The incoming interface is not known anymore in POST_ROUTING

Sorry, but... why? (that was my question indeed)

> - Locally generated packets don't even have an incoming interface

So what?
If you could use -i, then locally generated packets wouldn't match
(that's not a problem because you would do it on purpose).
If you don't, it would work as it used to till now.

 Herve

-- 
 _
(°=  Hervé Eychenne
//)
v_/_ WallFire project:  http://www.wallfire.org/

Re: SNAT from multiple interfaces with the same IP?

[Patrick McHardy]

Herve Eychenne wrote:
> On Sun, Dec 04, 2005 at 05:02:09PM +0100, Patrick McHardy wrote:
> 
>>- The incoming interface is not known anymore in POST_ROUTING
> 
> Sorry, but... why? (that was my question indeed)

In the input path the incoming interface is stored in the skb
in skb->dev. On the output path (POST_ROUTING) it contains the
outgoing interface. This might actually be changeable with not
too much effort, one of my IPsec patches already reorders the
POST_ROUTING hook.

>>- Locally generated packets don't even have an incoming interface
> 
> So what?
> If you could use -i, then locally generated packets wouldn't match
> (that's not a problem because you would do it on purpose).
> If you don't, it would work as it used to till now.

Yes, that wouldn't be problem.