Re: iptables NAT routing issues

[Pascal Hambourg <pascal.mail@plouf.fr.eu.org>]

Bas Verhoeven a écrit :
>>
>>> Assuming that the outbound server is the default gateway for the web 
>>> server and receives the return traffic, of course.
>>
>> You'd be kinda screwed if that was not the case.
> 
> The webserver has its own gateway, and that's not the outer box.

Don't look further. Here is why it does not work.

> Is there really no solution for this?

Use the outer box as a gateway, if it is in the same network. You do not 
have to use it as the default gateway for all traffic but at least for 
the HTTP return traffic. This could be done with iptables and advanced 
routing on the web server, for instance using the source port 80 to MARK 
packets or using CONNMARK/connmark.

You could try to use the NOTRACK target on the web server in order to 
prevent the incoming SYN packets from creating a new connection, so the 
replies could be SNATed. But I would not bet a euro-cent on such a dirty 
method. If someone asks who suggested it, don't say it's me. ;-)