Re: DNAT and source IP

[Daniel Huhardeaux <tech@tootai.net>]

Jan Engelhardt a écrit :
> On Tuesday 2009-10-20 10:16, Daniel Huhardeaux wrote:
>> I'm running few virtual machines (kvm+libvirt) on a server (Debian Lenny +
>> backport kernel 2.6.30) with one public IP and having IP private range
>> 10.99.0.1 for host, one for mail and web VM (10.99.0.13), another for telephony
>> VM (10.99.0.11).
>>
>> Everything is working well (DNAT) but something is disturbing me: for instance,
>> on smtp server, all incoming tcp packets are marked with 10.99.0.1 source IP
>> and I would like to have "transparent DNAT" which keep the original IP.
> 
> You need tproxy then, and not NAT.
> 

Hi Jan,

I think I loaded the well known modules

~$sudo lsmod|grep nf
nf_tproxy_core          3040  1 xt_TPROXY,[permanent]
nf_nat                 20068  2 ipt_MASQUERADE,iptable_nat
nf_conntrack_ipv4      15240  15 iptable_nat,nf_nat
nf_conntrack           70000  5 
ipt_MASQUERADE,xt_state,iptable_nat,nf_nat,nf_conntrack_ipv4
nf_defrag_ipv4          2288  2 xt_TPROXY,nf_conntrack_ipv4

but can't get it work.

 From some doc a table should exist (?)

sudo /sbin/iptables -t tproxy -F
iptables v1.4.2: can't initialize iptables table `tproxy': Table does 
not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.

Others say it's a target rule but I can't get it work

~$ sudo iptables -t mangle -A PREROUTING -p tcp --dport 25 -j TPROXY 
--on-port 25 --on-ip 10.1.70.13
iptables v1.4.2: Unknown arg `(null)'
Try `iptables -h' or 'iptables --help' for more information.

Thanks for any hint and good and complete doc if any.

-- 
Daniel
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html