Iptables proxy to a different network

Iptables proxy to a different network

[Andrus, Mr. Brian (Contractor)]

Ok, this is maybe an odd one.
I have a system with a single nic and ip address a.b.c.1 (system A)
I want to proxy incoming requests to port 80 to a different system on a
different subnet of x.y.z.1 (system B)

On system a.b.c.1, I am trying the following in my
/etc/sysconfig/iptables:
-----------
*nat
-A PREROUTING -p tcp --dport 80 -j DNAT --to x.y.z:80
COMMIT
-----------

This seems to ALMOST work. The request from a client system (System C)
go to System A, get rewritten and are received by system B. System B
seems to be responding, trying to send to System C directly, but (I
think) System C is expecting its response to be from system A, not
System B, so it ignores the responses. At least, I see that kind of
traffic with tcpdump on each system.

Any help/ideas here? Perhaps there is a different approach other than
iptables too. FWIW, I want System A to be able to proxy http, dns and
ftp to System B on a different network.


Brian Andrus

Re: Iptables proxy to a different network

[Pascal Hambourg]

Hello,

Andrus, Mr. Brian (Contractor) a écrit :
> I have a system with a single nic and ip address a.b.c.1 (system A)
> I want to proxy incoming requests to port 80 to a different system on a
> different subnet of x.y.z.1 (system B)
> 
> On system a.b.c.1, I am trying the following in my
> /etc/sysconfig/iptables:
> -----------
> *nat
> -A PREROUTING -p tcp --dport 80 -j DNAT --to x.y.z:80
> COMMIT
> -----------
> 
> This seems to ALMOST work. The request from a client system (System C)
> go to System A, get rewritten and are received by system B. System B
> seems to be responding, trying to send to System C directly, but (I
> think) System C is expecting its response to be from system A, not
> System B, so it ignores the responses.

As usual. Known issue.
If you cannot or do not wish to prevent direct routing between the 
client and the server, you must SNAT the forwarded connections in the 
POSTROUTING chain.

Re: Iptables proxy to a different network

[Jan Engelhardt]

On Feb 9 2007 12:27, Pascal Hambourg wrote:
>> -----------
>> *nat
>> -A PREROUTING -p tcp --dport 80 -j DNAT --to x.y.z:80
>> COMMIT
>> -----------
>> 
>> This seems to ALMOST work. The request from a client system (System C)
>> go to System A, get rewritten and are received by system B. System B
>> seems to be responding, trying to send to System C directly, but (I
>> think) System C is expecting its response to be from system A, not
>> System B, so it ignores the responses.
>
> As usual. Known issue.
> If you cannot or do not wish to prevent direct routing between the client and
> the server, you must SNAT the forwarded connections in the POSTROUTING chain.

Or make it so that any packets from C pass B. For example, by setting up
your proxy box as a router or bridge (both approaches work) in the middle.


Jan
-- 
ft: http://freshmeat.net/p/chaostables/

Re: Iptables proxy to a different network

[Pascal Hambourg]

Jan Engelhardt a écrit :
> On Feb 9 2007 12:27, Pascal Hambourg wrote:
> 
>>>-----------
>>>*nat
>>>-A PREROUTING -p tcp --dport 80 -j DNAT --to x.y.z:80
>>>COMMIT
>>>-----------
>>
>>If you cannot or do not wish to prevent direct routing between the client and
>>the server, you must SNAT the forwarded connections in the POSTROUTING chain.
> 
> Or make it so that any packets from C pass B.

This is what I meant when I wrote "prevent direct routing between the 
client and the server".

> For example, by setting up
> your proxy box as a router or bridge (both approaches work) in the middle.

I may be wrong, but doing IP NAT on a bridge seems to me quite 
unnatural and troublesome.

RE: Iptables proxy to a different network

[Andrus, Mr. Brian (Contractor)]

Hmmm.

So to properly do this, I _must_ SNAT the connection and route them back from system C via system B?
I was afraid of that. Not sure how I would route them because System C is on a different subnet than system B.

Diagram:

+---------------+
|   System A    |
+-------+-------+
        |
{===============}
{    Internet   }
{===============}
        |
+---------------+        +---A.B.C.x-----+
|    Router     +--------|   System B    +
+-------+-------+        +---------------+
        |
+-------+-------+
|   System C    |
+---X.Y.Z.x-----+


To make matters worse, System C runs Windoze. I am trying to have A.B.C.x be my DMZ with System B as my proxy for various services.

Brian



-----Original Message-----
From: netfilter-bounces@lists.netfilter.org [mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of Pascal Hambourg
Sent: Friday, February 09, 2007 7:22 AM
To: netfilter@lists.netfilter.org
Subject: Re: Iptables proxy to a different network

Jan Engelhardt a écrit :
> On Feb 9 2007 12:27, Pascal Hambourg wrote:
> 
>>>-----------
>>>*nat
>>>-A PREROUTING -p tcp --dport 80 -j DNAT --to x.y.z:80 COMMIT
>>>-----------
>>
>>If you cannot or do not wish to prevent direct routing between the 
>>client and the server, you must SNAT the forwarded connections in the POSTROUTING chain.
> 
> Or make it so that any packets from C pass B.

This is what I meant when I wrote "prevent direct routing between the client and the server".

> For example, by setting up
> your proxy box as a router or bridge (both approaches work) in the middle.

I may be wrong, but doing IP NAT on a bridge seems to me quite unnatural and troublesome.

Re: Iptables proxy to a different network

[Pascal Hambourg]

Andrus, Mr. Brian (Contractor) a écrit :
> 
> So to properly do this, I _must_ SNAT the connection

It is a possibility.

> and route them back from system C via system B?

"Or", not "and". If you SNAT, the return traffic will be routed properly.

> Diagram:
> 
> +---------------+
> |   System A    |
> +-------+-------+
>         |
> {===============}
> {    Internet   }
> {===============}
>         |
> +---------------+        +---A.B.C.x-----+
> |    Router     +--------|   System B    +
> +-------+-------+        +---------------+
>         |
> +-------+-------+
> |   System C    |
> +---X.Y.Z.x-----+

This is getting complicated...
In your first message, you said that A (the proxy) was a.b.c.1 and  B 
(the server) was x.y.z.1.
In this diagram, where are the client, the proxy and the server ?

RE: Iptables proxy to a different network

[Andrus, Mr. Brian (Contractor)]

My apologies.

In the diagram:
System A: Client
System B: Proxy
System C: Server 



Brian Andrus

-----Original Message-----
From: netfilter-bounces@lists.netfilter.org [mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of Pascal Hambourg
Sent: Friday, February 09, 2007 9:01 AM
To: netfilter@lists.netfilter.org
Subject: Re: Iptables proxy to a different network

Andrus, Mr. Brian (Contractor) a écrit :
> 
> So to properly do this, I _must_ SNAT the connection

It is a possibility.

> and route them back from system C via system B?

"Or", not "and". If you SNAT, the return traffic will be routed properly.

> Diagram:
> 
> +---------------+
> |   System A    |
> +-------+-------+
>         |
> {===============}
> {    Internet   }
> {===============}
>         |
> +---------------+        +---A.B.C.x-----+
> |    Router     +--------|   System B    +
> +-------+-------+        +---------------+
>         |
> +-------+-------+
> |   System C    |
> +---X.Y.Z.x-----+

This is getting complicated...
In your first message, you said that A (the proxy) was a.b.c.1 and  B (the server) was x.y.z.1.
In this diagram, where are the client, the proxy and the server ?

Re: Iptables proxy to a different network

[Pascal Hambourg]

Andrus, Mr. Brian (Contractor) a écrit :
> 
> In the diagram:
> System A: Client
> System B: Proxy
> System C: Server
[...]
>>+---------------+
>>|   System A    |
>>+-------+-------+
>>        |
>>{===============}
>>{    Internet   }
>>{===============}
>>        |
>>+---------------+        +---A.B.C.x-----+
>>|    Router     +--------|   System B    +
>>+-------+-------+        +---------------+
>>        |
>>+-------+-------+
>>|   System C    |
>>+---X.Y.Z.x-----+

If you have the following rule in system B's nat table :

-A PREROUTING -p tcp --dport 80 -j DNAT --to ip_C

you just need to add the following rule :

-A POSTROUTING -d ip_C -p tcp --dport 80 -j SNAT --to ip_B

System C will see ip_B as the client address and will send the replies 
back to it, so system B can put back the original addresses.

I suppose you are aware that the router would be a much better place to 
to the DNAT that system B. Actually you would not need system B. I am 
not sure I understand the purpose of this setup.

Re: Iptables proxy to a different network

[Jan Engelhardt]

On Feb 9 2007 16:22, Pascal Hambourg wrote:
>> On Feb 9 2007 12:27, Pascal Hambourg wrote:
>> For example, by setting up
>> your proxy box as a router or bridge (both approaches work) in the middle.
>
> I may be wrong, but doing IP NAT on a bridge seems to me quite unnatural and
> troublesome.

A bridge is like a 'direct connection' so you cannot use NAT. In fact, you
don't need, the next router will have to do it instread.

>
>

Jan
-- 
ft: http://freshmeat.net/p/chaostables/

Re: Iptables proxy to a different network

[Pascal Hambourg]

Jan Engelhardt a écrit :
>>
>>I may be wrong, but doing IP NAT on a bridge seems to me quite unnatural and
>>troublesome.
> 
> A bridge is like a 'direct connection' so you cannot use NAT.

My idea of a bridge is a kind of software switch.
Then why did you mention "setting up your proxy box as bridge" ?

Re: Iptables proxy to a different network

[Jan Engelhardt]

On Feb 9 2007 22:38, Pascal Hambourg wrote:
> Jan Engelhardt a écrit :
>> > 
>> > I may be wrong, but doing IP NAT on a bridge seems to me quite
>> > unnatural and
>> > troublesome.
>> 
>> A bridge is like a 'direct connection' so you cannot use NAT.
>
> My idea of a bridge is a kind of software switch.
> Then why did you mention "setting up your proxy box as bridge" ?

Ok so I confused what the OP wanted [-t nat -A PREROUTING -p tcp --dport 80 -j
--DNAT to x.y.z:80] with "the box does an rinetd-style approach" [e.g. squid],
so that the connection is not DNATed (A->C) but two connections actually exist
(A->B, B->C).


However, the more I think of it, there actually is a way with
proxy-on-a-bridge. Though, it's more like "degrading the bridge to a router":

ebtables -t broute -A BROUTING -i Intern -p tcp --dport 80 -j DROP;
ebtables -t broute -A BROUTING -o Extern -p tcp --sport 80 -j DROP;


Jan
-- 
ft: http://freshmeat.net/p/chaostables/

Re: Iptables proxy to a different network

[R. DuFresne]

[-- Attachment #1: Type: TEXT/PLAIN, Size: 1235 bytes --]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Fri, 9 Feb 2007, Pascal Hambourg wrote:

> Jan Engelhardt a écrit :
>>> 
>>> I may be wrong, but doing IP NAT on a bridge seems to me quite unnatural 
>>> and
>>> troublesome.
>> 
>> A bridge is like a 'direct connection' so you cannot use NAT.
>
> My idea of a bridge is a kind of software switch.
> Then why did you mention "setting up your proxy box as bridge" ?
>
>


My understanding of a bridge, is that it is a transparent connector of two 
distinct broadcast domains.  At least in their earlier and older first 
implementations.


Perhaps I'm showing my age?!...


Thanks,


Ron DuFresne
- -- 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         admin & senior security consultant:  sysinfo.com
                         http://sysinfo.com
Key fingerprint = 9401 4B13 B918 164C 647A  E838 B2DF AFCC 94B0 6629

...We waste time looking for the perfect lover
instead of creating the perfect love.

                 -Tom Robbins <Still Life With Woodpecker>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)

iD8DBQFF0iNMst+vzJSwZikRArxJAKCMgPfeSo2PM2P0USICMHA4w+I8kQCeOJ9V
iYBgKm6pJHhmI6fOxT7QpKQ=
=pj67
-----END PGP SIGNATURE-----

Re: Iptables proxy to a different network

[Jan Engelhardt]

On Feb 13 2007 15:44, R. DuFresne wrote:
>> > > I may be wrong, but doing IP NAT on a bridge seems to me quite
>> > > unnatural and
>> > > troublesome.
>> > 
>> > A bridge is like a 'direct connection' so you cannot use NAT.
>> 
>> My idea of a bridge is a kind of software switch.
>> Then why did you mention "setting up your proxy box as bridge" ?
>
> My understanding of a bridge, is that it is a transparent connector of two
> distinct broadcast domains.

...making it one broadcast domain.

> At least in their earlier and older first
> implementations.
>
> Perhaps I'm showing my age?!...

Everything is alright. Just see  
http://lists.netfilter.org/pipermail/netfilter/2007-February/068001.html


Jan
-- 
ft: http://freshmeat.net/p/chaostables/