Re: Basic Routing

[Pascal Hambourg <pascal.mail@plouf.fr.eu.org>]

Hello,

Grant Taylor a écrit :
> 
> You have to have some form of NAT for the aforementioned reason. However 
> it is possible to do this on a layer 2 device via EBTables / IPTables 
> with bridged netfilter traffic enabled.

Ebtables, are you sure ? AFAIK ebtables does only layer 2 MAC address 
translation, not IP address translation. Don't you mean bridge-nf aka 
bridge-netfilter instead of ebtables ?

> In essence from L2 you watch for any traffic coming from the L3 IP 
> address space in question and then NAT the L3 addresses with (on L2) to 
> be the actual L3 address you want to appear as.  The same thing happens 
> in reverse and you tend to have what appears to be a L3 ""router, but in 
> actuality it's purely an L2 device pretending to be / doing the function 
> of an L3 router.

It's far from being that simple. Doing stateful IP address translation 
at layer 2 requires other operations such as fragment reassembly because 
stateful NAT operates at the datagram level, not at the packet level, 
and rerouting and ARP lookup when the destination IP and MAC addresses 
change. IMO these are definitely not layer 2 operations.

> IPTables uses what is considered /stateful/ NAT.  Remember when IPTables 
> introduced connection tracking and the state match extension in 2.4 
> years ago?  Previously IPChains did not have such state.

Ipchains did not have a state match extension, but it had some 
connection tracking for its NAT features (masquerading and port forwarding).

> The (older ?) 
> installs of the IP (ip) command could do /stateless/ NAT.  I say older 
> because I'm not sure that the stateless NAT provided by IP exists any 
> more. ... (checking) ...  According to the IP man page, stateless NAT is 
> no longer supported:  "Warning: Route NAT is no longer supported in 
> Linux 2.6."

Actually the IP_ROUTE_NAT option enabling the old stateless NAT aka 
"fast NAT" or "route NAT" support in the kernel has been removed since 
kernel 2.6.9 only. But a new stateless NAT was added in kernel 2.6.24. 
See option NET_ACT_NAT in the "QoS and/or fair queueing" menu (yeah, I 
guess the location may seem misleading). I have not dug into it, but I 
think it can be set up with the "tc" tool from the iproute package. It 
requires iproute2-2.6.24-rc7 at least.