NAT with two external IP numbers

[Mogens Kjaer <mk@crc.dk>]

I'm trying to solve a problem:

We have now:
Internal network: 172.20.0.0/16
External network: 130.226.184.38

This works without problems running a Linux
box with iptables and MASQUERADING

The problem is, that due to a license agreement
(online journal access), some of our users on
the 172.20.0.0 network must have access, and some
don't.

My idea was:

Give the linux box two IP numbers externally,
e.g. 130.226.184.38 and 130.226.184.39, register
130.226.184.38 with the journal, change the
internal IP numbers so that:

172.20.0.0/17 has access
172.20.128.0/17 does not have access

So I want 172.20.0.1 - 172.20.127.255 to be
masqueraded as 130.226.184.38 externally,
and 172.20.128.0 - 172.20.255.254 to be
masqueraded as 130.226.184.39

I've tried adding two IP numbers externally:

# ifconfig
eth0      Link encap:Ethernet  HWaddr 00:02:55:11:EF:03
           inet addr:130.226.184.38  Bcast:130.226.184.255 
Mask:255.255.255.0
           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
           RX packets:1774 errors:0 dropped:0 overruns:0 frame:0
           TX packets:2543 errors:0 dropped:0 overruns:0 carrier:0
           collisions:0 txqueuelen:1000
           RX bytes:298539 (291.5 KiB)  TX bytes:237100 (231.5 KiB)

eth0:1    Link encap:Ethernet  HWaddr 00:02:55:11:EF:03
           inet addr:130.226.184.39  Bcast:130.226.184.255 
Mask:255.255.255.0
           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

and use the following when setting up masquerading:

/sbin/iptables -t nat -A POSTROUTING -s 172.20.0.0/17 -o eth0 -j MASQUERADE
/sbin/iptables -t nat -A POSTROUTING -s 172.20.128.0/17 -o eth0:1 -j 
MASQUERADE

but it doesn't work. Packages comming from 172.20.128.0 addresses
does not get their source address changed, e.g. if I ping another
machine on the 130.226.184.x network from the 172.20.128.x network,
the machine will receive packets with a 172.20.128.x from address,
not 130.226.184.39

How do I solve this problem?

Mogens

-- 
Mogens Kjaer, Carlsberg A/S, Computer Department
Gamle Carlsberg Vej 10, DK-2500 Valby, Denmark
Phone: +45 33 27 53 25, Fax: +45 33 27 47 08
Email: mk@crc.dk Homepage: http://www.crc.dk