* [LARTC] Dual ISP routing and NAT problem
@ 2006-03-02 16:24 Mart Frauenlob
2006-03-06 17:23 ` Mart Frauenlob
` (3 more replies)
0 siblings, 4 replies; 5+ messages in thread
From: Mart Frauenlob @ 2006-03-02 16:24 UTC (permalink / raw)
To: lartc
Hello newsgroup,
I hope somebody with more routing experience then me can help me with
the problem I have.
The setup is as described below. A dual internet provider routing,
multiple local area networks, and a dmz network with one public and one
private ip range.
I followed the instructions at lartc.org, and so far everything is working.
The default route is via 'PROV_STATIC', only packets comming from LAN
192.168.111.0/24 are routed via 'PROV_DSL'.
Now if I want to do network address translation via iptables for certain
traffic coming into the dsl interface ppp0,
packets never reach their destination.
DNAT into DMZ or any of the LANs over the eth0 interface works as expected.
So for example applying a DNAT rule like:
'iptables -t nat -A PREROUTING -i ppp0 -d 217.92.8.242 -p tcp --dport 80
-j DNAT --to-destination 62.155.170.254'
fails.
Same for NAT attempts into the LANs 192.168.112.0/24 and 192.168.113.0/24.
While DNAT into LAN 192.168.111.0/24 works perfectly.
So I think the problem is that traffic from the DMZ and those two LANs
have the ip rules applied to end up in the the table 'PROV_STATIC'.
Which usually is what I want, but not in this case, where I want port or
protocol specific traffic to be routed differntly.
Is there a way to 'override' the default routing behaviour for i.e. http
traffic?
I tried the iptables ROUTE target, but did not get it working, but could
of course be my error.
Is there anything wrong with my current routing tables?
Thank you for any help you can give.
Best regards,
Mart
<------------------------------------------------->
Setup:
Firewall / Router:
2 external interfaces
3 lan interfaces
1 dmz interface
External interfaces:
1 - PROV_STATIC:
IP: 62.155.170.250
Network: 62.155.170.248/30
Interface: static interface eth0
global default route via: 62.155.170.249
2 - PROV_DSL:
IP: 217.92.8.242
Peer: 217.6.98.186
Interface: DSL interface ppp0 (pppoe over eth1)
DMZ interface:
IP_1: 62.155.170.253
Network_1: 62.155.170.252/30
IP_2: 192.168.0.1
Network_2: 192.168.0.0/24
Interface: eth4
LAN interfaces:
1: IP: 192.168.111.1
Network: 192.168.111.0/24
Interface: eth5
2: IP: 192.168.112.1
Network: 192.168.112.0/24
Interface: eth2
3: IP: 192.168.113.1
Network: 192.168.113.0/24
Interface: eth3
igor:/# ip route list table PROV_DSL
217.6.98.186 dev ppp0 proto kernel scope link src 217.92.8.242
62.155.170.248/30 dev eth0 scope link src 62.155.170.250
62.155.170.252/30 dev eth4 proto kernel scope link src 62.155.170.253
192.168.112.0/24 dev eth2 proto kernel scope link src 192.168.112.1
192.168.113.0/24 dev eth3 proto kernel scope link src 192.168.113.1
192.168.0.0/24 dev eth4 proto kernel scope link src 192.168.0.1
192.168.111.0/24 dev eth5 proto kernel scope link src 192.168.111.1
10.0.0.0/8 via 192.168.111.3 dev eth5 proto kernel src 192.168.111.1
127.0.0.0/8 dev lo scope link
default via 217.6.98.186 dev ppp0
igor:/# ip route list table PROV_STATIC
217.6.98.186 dev ppp0 proto kernel scope link src 217.92.8.242
62.155.170.248/30 dev eth0 scope link src 62.155.170.250
62.155.170.252/30 dev eth4 proto kernel scope link src 62.155.170.253
192.168.112.0/24 dev eth2 proto kernel scope link src 192.168.112.1
192.168.113.0/24 dev eth3 proto kernel scope link src 192.168.113.1
192.168.0.0/24 dev eth4 proto kernel scope link src 192.168.0.1
192.168.111.0/24 dev eth5 proto kernel scope link src 192.168.111.1
10.0.0.0/8 via 192.168.111.3 dev eth5 proto kernel src 192.168.111.1
127.0.0.0/8 dev lo scope link
default via 62.155.170.249 dev eth0
igor:/# ip route list
217.6.98.186 dev ppp0 proto kernel scope link src 217.92.8.242
62.155.170.248/30 dev eth0 proto kernel scope link src 62.155.170.250
62.155.170.252/30 dev eth4 proto kernel scope link src 62.155.170.253
192.168.112.0/24 dev eth2 proto kernel scope link src 192.168.112.1
192.168.113.0/24 dev eth3 proto kernel scope link src 192.168.113.1
192.168.0.0/24 dev eth4 proto kernel scope link src 192.168.0.1
192.168.111.0/24 dev eth5 proto kernel scope link src 192.168.111.1
10.0.0.0/8 via 192.168.111.3 dev eth5 proto kernel
default via 62.155.170.249 dev eth0
igor:/# ip rule list
0: from all lookup local
32759: from 192.168.0.0/24 lookup PROV_STATIC
32760: from 62.155.170.252/30 lookup PROV_STATIC
32761: from 192.168.113.0/24 lookup PROV_STATIC
32762: from 192.168.112.0/24 lookup PROV_STATIC
32763: from 192.168.111.0/24 lookup PROV_DSL
32764: from 217.92.8.242 lookup PROV_DSL
32765: from 62.155.170.250 lookup PROV_STATIC
32766: from all lookup main
32767: from all lookup default
<------------------------------------------------->
_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [LARTC] Dual ISP routing and NAT problem
2006-03-02 16:24 [LARTC] Dual ISP routing and NAT problem Mart Frauenlob
@ 2006-03-06 17:23 ` Mart Frauenlob
2006-03-07 13:14 ` Nathan Rodrigues Levy
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: Mart Frauenlob @ 2006-03-06 17:23 UTC (permalink / raw)
To: lartc
Hello,
nobody even commented this post?
What's wrong about it?
Thank you
Mart
Mart Frauenlob wrote:
> Hello newsgroup,
>
> I hope somebody with more routing experience then me can help me with
> the problem I have.
>
> The setup is as described below. A dual internet provider routing,
> multiple local area networks, and a dmz network with one public and one
> private ip range.
> I followed the instructions at lartc.org, and so far everything is working.
> The default route is via 'PROV_STATIC', only packets comming from LAN
> 192.168.111.0/24 are routed via 'PROV_DSL'.
> Now if I want to do network address translation via iptables for certain
> traffic coming into the dsl interface ppp0,
> packets never reach their destination.
> DNAT into DMZ or any of the LANs over the eth0 interface works as expected.
> So for example applying a DNAT rule like:
> 'iptables -t nat -A PREROUTING -i ppp0 -d 217.92.8.242 -p tcp --dport 80
> -j DNAT --to-destination 62.155.170.254'
> fails.
>
> Same for NAT attempts into the LANs 192.168.112.0/24 and 192.168.113.0/24.
> While DNAT into LAN 192.168.111.0/24 works perfectly.
>
> So I think the problem is that traffic from the DMZ and those two LANs
> have the ip rules applied to end up in the the table 'PROV_STATIC'.
> Which usually is what I want, but not in this case, where I want port or
> protocol specific traffic to be routed differntly.
> Is there a way to 'override' the default routing behaviour for i.e. http
> traffic?
> I tried the iptables ROUTE target, but did not get it working, but could
> of course be my error.
> Is there anything wrong with my current routing tables?
>
> Thank you for any help you can give.
>
> Best regards,
>
> Mart
>
> <------------------------------------------------->
> Setup:
>
> Firewall / Router:
> 2 external interfaces
> 3 lan interfaces
> 1 dmz interface
>
> External interfaces:
> 1 - PROV_STATIC:
> IP: 62.155.170.250
> Network: 62.155.170.248/30
> Interface: static interface eth0
> global default route via: 62.155.170.249
> 2 - PROV_DSL:
> IP: 217.92.8.242
> Peer: 217.6.98.186
> Interface: DSL interface ppp0 (pppoe over eth1)
>
> DMZ interface:
> IP_1: 62.155.170.253
> Network_1: 62.155.170.252/30
> IP_2: 192.168.0.1
> Network_2: 192.168.0.0/24
> Interface: eth4
>
> LAN interfaces:
> 1: IP: 192.168.111.1
> Network: 192.168.111.0/24
> Interface: eth5
> 2: IP: 192.168.112.1
> Network: 192.168.112.0/24
> Interface: eth2
> 3: IP: 192.168.113.1
> Network: 192.168.113.0/24
> Interface: eth3
>
> igor:/# ip route list table PROV_DSL
> 217.6.98.186 dev ppp0 proto kernel scope link src 217.92.8.242
> 62.155.170.248/30 dev eth0 scope link src 62.155.170.250
> 62.155.170.252/30 dev eth4 proto kernel scope link src 62.155.170.253
> 192.168.112.0/24 dev eth2 proto kernel scope link src 192.168.112.1
> 192.168.113.0/24 dev eth3 proto kernel scope link src 192.168.113.1
> 192.168.0.0/24 dev eth4 proto kernel scope link src 192.168.0.1
> 192.168.111.0/24 dev eth5 proto kernel scope link src 192.168.111.1
> 10.0.0.0/8 via 192.168.111.3 dev eth5 proto kernel src 192.168.111.1
> 127.0.0.0/8 dev lo scope link
> default via 217.6.98.186 dev ppp0
>
>
> igor:/# ip route list table PROV_STATIC
> 217.6.98.186 dev ppp0 proto kernel scope link src 217.92.8.242
> 62.155.170.248/30 dev eth0 scope link src 62.155.170.250
> 62.155.170.252/30 dev eth4 proto kernel scope link src 62.155.170.253
> 192.168.112.0/24 dev eth2 proto kernel scope link src 192.168.112.1
> 192.168.113.0/24 dev eth3 proto kernel scope link src 192.168.113.1
> 192.168.0.0/24 dev eth4 proto kernel scope link src 192.168.0.1
> 192.168.111.0/24 dev eth5 proto kernel scope link src 192.168.111.1
> 10.0.0.0/8 via 192.168.111.3 dev eth5 proto kernel src 192.168.111.1
> 127.0.0.0/8 dev lo scope link
> default via 62.155.170.249 dev eth0
>
>
> igor:/# ip route list
> 217.6.98.186 dev ppp0 proto kernel scope link src 217.92.8.242
> 62.155.170.248/30 dev eth0 proto kernel scope link src 62.155.170.250
> 62.155.170.252/30 dev eth4 proto kernel scope link src 62.155.170.253
> 192.168.112.0/24 dev eth2 proto kernel scope link src 192.168.112.1
> 192.168.113.0/24 dev eth3 proto kernel scope link src 192.168.113.1
> 192.168.0.0/24 dev eth4 proto kernel scope link src 192.168.0.1
> 192.168.111.0/24 dev eth5 proto kernel scope link src 192.168.111.1
> 10.0.0.0/8 via 192.168.111.3 dev eth5 proto kernel
> default via 62.155.170.249 dev eth0
>
>
> igor:/# ip rule list
> 0: from all lookup local
> 32759: from 192.168.0.0/24 lookup PROV_STATIC
> 32760: from 62.155.170.252/30 lookup PROV_STATIC
> 32761: from 192.168.113.0/24 lookup PROV_STATIC
> 32762: from 192.168.112.0/24 lookup PROV_STATIC
> 32763: from 192.168.111.0/24 lookup PROV_DSL
> 32764: from 217.92.8.242 lookup PROV_DSL
> 32765: from 62.155.170.250 lookup PROV_STATIC
> 32766: from all lookup main
> 32767: from all lookup default
> <------------------------------------------------->
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
>
_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [LARTC] Dual ISP routing and NAT problem
2006-03-02 16:24 [LARTC] Dual ISP routing and NAT problem Mart Frauenlob
2006-03-06 17:23 ` Mart Frauenlob
@ 2006-03-07 13:14 ` Nathan Rodrigues Levy
2006-03-07 15:15 ` Aleksander
2006-03-09 12:00 ` Markus Schulz
3 siblings, 0 replies; 5+ messages in thread
From: Nathan Rodrigues Levy @ 2006-03-07 13:14 UTC (permalink / raw)
To: lartc
[-- Attachment #1.1: Type: text/plain, Size: 5992 bytes --]
Hi Mart,
It seems that you did not applied the patches from
http://www.ssi.bg/~ja/#routes
There are also a howto called nano.txt that shows you how to setup what you want.
Nathan.
Mart Frauenlob <mart.frauenlob@chello.at> escreveu: Hello,
nobody even commented this post?
What's wrong about it?
Thank you
Mart
Mart Frauenlob wrote:
> Hello newsgroup,
>
> I hope somebody with more routing experience then me can help me with
> the problem I have.
>
> The setup is as described below. A dual internet provider routing,
> multiple local area networks, and a dmz network with one public and one
> private ip range.
> I followed the instructions at lartc.org, and so far everything is working.
> The default route is via 'PROV_STATIC', only packets comming from LAN
> 192.168.111.0/24 are routed via 'PROV_DSL'.
> Now if I want to do network address translation via iptables for certain
> traffic coming into the dsl interface ppp0,
> packets never reach their destination.
> DNAT into DMZ or any of the LANs over the eth0 interface works as expected.
> So for example applying a DNAT rule like:
> 'iptables -t nat -A PREROUTING -i ppp0 -d 217.92.8.242 -p tcp --dport 80
> -j DNAT --to-destination 62.155.170.254'
> fails.
>
> Same for NAT attempts into the LANs 192.168.112.0/24 and 192.168.113.0/24.
> While DNAT into LAN 192.168.111.0/24 works perfectly.
>
> So I think the problem is that traffic from the DMZ and those two LANs
> have the ip rules applied to end up in the the table 'PROV_STATIC'.
> Which usually is what I want, but not in this case, where I want port or
> protocol specific traffic to be routed differntly.
> Is there a way to 'override' the default routing behaviour for i.e. http
> traffic?
> I tried the iptables ROUTE target, but did not get it working, but could
> of course be my error.
> Is there anything wrong with my current routing tables?
>
> Thank you for any help you can give.
>
> Best regards,
>
> Mart
>
> <------------------------------------------------->
> Setup:
>
> Firewall / Router:
> 2 external interfaces
> 3 lan interfaces
> 1 dmz interface
>
> External interfaces:
> 1 - PROV_STATIC:
> IP: 62.155.170.250
> Network: 62.155.170.248/30
> Interface: static interface eth0
> global default route via: 62.155.170.249
> 2 - PROV_DSL:
> IP: 217.92.8.242
> Peer: 217.6.98.186
> Interface: DSL interface ppp0 (pppoe over eth1)
>
> DMZ interface:
> IP_1: 62.155.170.253
> Network_1: 62.155.170.252/30
> IP_2: 192.168.0.1
> Network_2: 192.168.0.0/24
> Interface: eth4
>
> LAN interfaces:
> 1: IP: 192.168.111.1
> Network: 192.168.111.0/24
> Interface: eth5
> 2: IP: 192.168.112.1
> Network: 192.168.112.0/24
> Interface: eth2
> 3: IP: 192.168.113.1
> Network: 192.168.113.0/24
> Interface: eth3
>
> igor:/# ip route list table PROV_DSL
> 217.6.98.186 dev ppp0 proto kernel scope link src 217.92.8.242
> 62.155.170.248/30 dev eth0 scope link src 62.155.170.250
> 62.155.170.252/30 dev eth4 proto kernel scope link src 62.155.170.253
> 192.168.112.0/24 dev eth2 proto kernel scope link src 192.168.112.1
> 192.168.113.0/24 dev eth3 proto kernel scope link src 192.168.113.1
> 192.168.0.0/24 dev eth4 proto kernel scope link src 192.168.0.1
> 192.168.111.0/24 dev eth5 proto kernel scope link src 192.168.111.1
> 10.0.0.0/8 via 192.168.111.3 dev eth5 proto kernel src 192.168.111.1
> 127.0.0.0/8 dev lo scope link
> default via 217.6.98.186 dev ppp0
>
>
> igor:/# ip route list table PROV_STATIC
> 217.6.98.186 dev ppp0 proto kernel scope link src 217.92.8.242
> 62.155.170.248/30 dev eth0 scope link src 62.155.170.250
> 62.155.170.252/30 dev eth4 proto kernel scope link src 62.155.170.253
> 192.168.112.0/24 dev eth2 proto kernel scope link src 192.168.112.1
> 192.168.113.0/24 dev eth3 proto kernel scope link src 192.168.113.1
> 192.168.0.0/24 dev eth4 proto kernel scope link src 192.168.0.1
> 192.168.111.0/24 dev eth5 proto kernel scope link src 192.168.111.1
> 10.0.0.0/8 via 192.168.111.3 dev eth5 proto kernel src 192.168.111.1
> 127.0.0.0/8 dev lo scope link
> default via 62.155.170.249 dev eth0
>
>
> igor:/# ip route list
> 217.6.98.186 dev ppp0 proto kernel scope link src 217.92.8.242
> 62.155.170.248/30 dev eth0 proto kernel scope link src 62.155.170.250
> 62.155.170.252/30 dev eth4 proto kernel scope link src 62.155.170.253
> 192.168.112.0/24 dev eth2 proto kernel scope link src 192.168.112.1
> 192.168.113.0/24 dev eth3 proto kernel scope link src 192.168.113.1
> 192.168.0.0/24 dev eth4 proto kernel scope link src 192.168.0.1
> 192.168.111.0/24 dev eth5 proto kernel scope link src 192.168.111.1
> 10.0.0.0/8 via 192.168.111.3 dev eth5 proto kernel
> default via 62.155.170.249 dev eth0
>
>
> igor:/# ip rule list
> 0: from all lookup local
> 32759: from 192.168.0.0/24 lookup PROV_STATIC
> 32760: from 62.155.170.252/30 lookup PROV_STATIC
> 32761: from 192.168.113.0/24 lookup PROV_STATIC
> 32762: from 192.168.112.0/24 lookup PROV_STATIC
> 32763: from 192.168.111.0/24 lookup PROV_DSL
> 32764: from 217.92.8.242 lookup PROV_DSL
> 32765: from 62.155.170.250 lookup PROV_STATIC
> 32766: from all lookup main
> 32767: from all lookup default
> <------------------------------------------------->
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
>
_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
---------------------------------
Yahoo! Acesso Grátis
Internet rápida e grátis. Instale o discador agora!
[-- Attachment #1.2: Type: text/html, Size: 7016 bytes --]
[-- Attachment #2: Type: text/plain, Size: 143 bytes --]
_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [LARTC] Dual ISP routing and NAT problem
2006-03-02 16:24 [LARTC] Dual ISP routing and NAT problem Mart Frauenlob
2006-03-06 17:23 ` Mart Frauenlob
2006-03-07 13:14 ` Nathan Rodrigues Levy
@ 2006-03-07 15:15 ` Aleksander
2006-03-09 12:00 ` Markus Schulz
3 siblings, 0 replies; 5+ messages in thread
From: Aleksander @ 2006-03-07 15:15 UTC (permalink / raw)
To: lartc
Mart Frauenlob wrote:
> So for example applying a DNAT rule like:
> 'iptables -t nat -A PREROUTING -i ppp0 -d 217.92.8.242 -p tcp --dport
> 80 -j DNAT --to-destination 62.155.170.254'
> fails.
Are you sure do not drop the packets later in the FORWARD chain?
Make sure ip forwarding is enabled, make sure that your routes are OK
and then try sniffing with tcpdump to find where your packets are lost.
I'd start with a simpler setup, make sure it works and then add rules
and routes.
HTH,
Alex
_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [LARTC] Dual ISP routing and NAT problem
2006-03-02 16:24 [LARTC] Dual ISP routing and NAT problem Mart Frauenlob
` (2 preceding siblings ...)
2006-03-07 15:15 ` Aleksander
@ 2006-03-09 12:00 ` Markus Schulz
3 siblings, 0 replies; 5+ messages in thread
From: Markus Schulz @ 2006-03-09 12:00 UTC (permalink / raw)
To: lartc
Am Donnerstag, 2. März 2006 17:24 schrieb Mart Frauenlob:
> Hello newsgroup,
>
> I hope somebody with more routing experience then me can help me with
> the problem I have.
>
> The setup is as described below. A dual internet provider routing,
> multiple local area networks, and a dmz network with one public and
> one private ip range.
> I followed the instructions at lartc.org, and so far everything is
> working. The default route is via 'PROV_STATIC', only packets comming
> from LAN 192.168.111.0/24 are routed via 'PROV_DSL'.
> Now if I want to do network address translation via iptables for
> certain traffic coming into the dsl interface ppp0,
> packets never reach their destination.
> DNAT into DMZ or any of the LANs over the eth0 interface works as
> expected. So for example applying a DNAT rule like:
> 'iptables -t nat -A PREROUTING -i ppp0 -d 217.92.8.242 -p tcp --dport
> 80 -j DNAT --to-destination 62.155.170.254'
> fails.
>
> Same for NAT attempts into the LANs 192.168.112.0/24 and
> 192.168.113.0/24. While DNAT into LAN 192.168.111.0/24 works
> perfectly.
>
> So I think the problem is that traffic from the DMZ and those two
> LANs have the ip rules applied to end up in the the table
> 'PROV_STATIC'. Which usually is what I want, but not in this case,
> where I want port or protocol specific traffic to be routed
> differntly.
> Is there a way to 'override' the default routing behaviour for i.e.
> http traffic?
yes, mark the traffic with iptables and route them with a higher prio
routing rule differently.
for example:
iptables -t mangle -I PREROUTING ... -j MARK --set-mark 0x01
#insert rule for all marked packets to look at table 100 for routing
entries.
ip rule add prio $PRIO fwmark 0x01 table 100
#insert your routing entries for alle marked packets into table 100
ip route add <...> table 100
...
$IP must changed according your setup.
the $PRIO must be changed to take at the right place. If i understand
your problem correctly the prio must be below 32759 and $IP=all. But
i'm not sure if i understand it right.
--
Markus Schulz
modprobe windows
modprobe: This module will TAINT the kernel
_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2006-03-09 12:00 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2006-03-02 16:24 [LARTC] Dual ISP routing and NAT problem Mart Frauenlob
2006-03-06 17:23 ` Mart Frauenlob
2006-03-07 13:14 ` Nathan Rodrigues Levy
2006-03-07 15:15 ` Aleksander
2006-03-09 12:00 ` Markus Schulz
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.