Re: Mapping external to internal IP addresses

[Mart Frauenlob <mart.frauenlob@chello.at>]

On 23.12.2009 21:40, Pascal Hambourg wrote:
> Hello,
> 
> Mart Frauenlob a écrit :
>>
>> Nick Peirson wrote:
>>>
>>> We've got a couple of servers with external IP addresses NAT'd to internal
>>> IP addresses. Unfortunately the firewall that's performing the NAT isn't
>>> under our control and we have a problem where the servers can't access each
>>> other via their external IPs.
> 
> This is a common problem.
> 
>>> This causes a problem when we use domain names
>>> on the servers, as the DNS lookup returns the external IP address. Ideally
>>> I'd like to avoid maintaing hosts files or an internal DNS server.
>>>
>>> I looked to solve this with a iptables rule on each of the servers as
>>> follows:
>>> iptables -t mangle -A PREROUTING -d 1.1.1.32/29 -j NETMAP --to 2.2.2.32/29
>>>
>>> where 1.1.1.32/29 is the range of external IPs and 2.2.2.32/29 is the range
>>> of internal IPs.
> 
> Note : the range 192.0.2.0/24 is available and reserved for examples and
> documentation. Feel free to use is instead of addresses allocated to
> someone else.
> 
>>> I was expecting this to map the IP address from the
>>> external to the internal IP.
> 
> Assuming that 1.1.1.32+n maps to 2.2.2.32+n.
> 
>>> Firstly, I'm not sure if this would work at all, and if I'm heading in
>>> completely the wrong direction and someone has a better solution, I'd be
>>> happy to hear it.
> 
> Can't you just assign the external addresses to the servers as secondary
> addresses ?
> 
>>> Secondly, if I've got the right idea my implementation is a little wrong.
>>> When I run the command, I get "iptables: Invalid argument", which doesn't
>>> provide much info, and I'm not sure how to go about debugging.
>>
>> wrong table, should be the nat table.
> 
> Wrong chain too. This is locally generated traffic, so the right chain
> is OUTPUT, not PREROUTING.


Oh, yes I was wrong :/ Don't know why I messed up. sorry for the noise.