DNAT and source IP

DNAT and source IP

[Daniel Huhardeaux]

Hello everybody,

I'm running few virtual machines (kvm+libvirt) on a server (Debian Lenny 
+ backport kernel 2.6.30) with one public IP and having IP private range 
10.99.0.1 for host, one for mail and web VM (10.99.0.13), another for 
telephony VM (10.99.0.11).

Everything is working well (DNAT) but something is disturbing me: for 
instance, on smtp server, all incoming tcp packets are marked with 
10.99.0.1 source IP and I would like to have "transparent DNAT" which 
keep the original IP.

I also tried with xinetd and his redirect feature, same problem. For 
telephony, using udp, it's also a problem.

My question is: is there a way to achive my needs with iptables (other 
solution?) or is bridging the only way?

Thanks for any feedback/idea

-- 
Daniel

Re: DNAT and source IP

[Jan Engelhardt]

On Tuesday 2009-10-20 10:16, Daniel Huhardeaux wrote:
>
> I'm running few virtual machines (kvm+libvirt) on a server (Debian Lenny +
> backport kernel 2.6.30) with one public IP and having IP private range
> 10.99.0.1 for host, one for mail and web VM (10.99.0.13), another for telephony
> VM (10.99.0.11).
>
> Everything is working well (DNAT) but something is disturbing me: for instance,
> on smtp server, all incoming tcp packets are marked with 10.99.0.1 source IP
> and I would like to have "transparent DNAT" which keep the original IP.

You need tproxy then, and not NAT.

Re: DNAT and source IP

[Daniel Huhardeaux]

Jan Engelhardt a écrit :
> On Tuesday 2009-10-20 10:16, Daniel Huhardeaux wrote:
>> I'm running few virtual machines (kvm+libvirt) on a server (Debian Lenny +
>> backport kernel 2.6.30) with one public IP and having IP private range
>> 10.99.0.1 for host, one for mail and web VM (10.99.0.13), another for telephony
>> VM (10.99.0.11).
>>
>> Everything is working well (DNAT) but something is disturbing me: for instance,
>> on smtp server, all incoming tcp packets are marked with 10.99.0.1 source IP
>> and I would like to have "transparent DNAT" which keep the original IP.
> 
> You need tproxy then, and not NAT.
> 

Hi Jan,

I think I loaded the well known modules

~$sudo lsmod|grep nf
nf_tproxy_core          3040  1 xt_TPROXY,[permanent]
nf_nat                 20068  2 ipt_MASQUERADE,iptable_nat
nf_conntrack_ipv4      15240  15 iptable_nat,nf_nat
nf_conntrack           70000  5 
ipt_MASQUERADE,xt_state,iptable_nat,nf_nat,nf_conntrack_ipv4
nf_defrag_ipv4          2288  2 xt_TPROXY,nf_conntrack_ipv4

but can't get it work.

 From some doc a table should exist (?)

sudo /sbin/iptables -t tproxy -F
iptables v1.4.2: can't initialize iptables table `tproxy': Table does 
not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.

Others say it's a target rule but I can't get it work

~$ sudo iptables -t mangle -A PREROUTING -p tcp --dport 25 -j TPROXY 
--on-port 25 --on-ip 10.1.70.13
iptables v1.4.2: Unknown arg `(null)'
Try `iptables -h' or 'iptables --help' for more information.

Thanks for any hint and good and complete doc if any.

-- 
Daniel
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: DNAT and source IP

[Daniel Huhardeaux]

Jan Engelhardt a écrit :
> On Tuesday 2009-10-20 10:16, Daniel Huhardeaux wrote:
>> I'm running few virtual machines (kvm+libvirt) on a server (Debian Lenny +
>> backport kernel 2.6.30) with one public IP and having IP private range
>> 10.99.0.1 for host, one for mail and web VM (10.99.0.13), another for telephony
>> VM (10.99.0.11).
>>
>> Everything is working well (DNAT) but something is disturbing me: for instance,
>> on smtp server, all incoming tcp packets are marked with 10.99.0.1 source IP
>> and I would like to have "transparent DNAT" which keep the original IP.
> 
> You need tproxy then, and not NAT.
> 
|[...]
|Others say it's a target rule but I can't get it work
|
|~$ sudo iptables -t mangle -A PREROUTING -p tcp --dport 25 -j TPROXY
|--on-port 25 --on-ip 10.1.70.13
|iptables v1.4.2: Unknown arg `(null)'
|Try `iptables -h' or 'iptables --help' for more information.
|
|Thanks for any hint and good and complete doc if any.

Got it, sorry for the noise: forgot to upgrade iptables to version 
1.4.4-2 from backports.

-- 
Daniel
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html