Re: Multiple SNAT

Re: Multiple SNAT

[Antony Stone]

On Tuesday 20 August 2002 9:56 pm, saki wrote:

> hello  i have internet cafe with 50 client and 1 server with 16 public
> address client1, client2, client3, client4  exit to ip.public.no.1
> client5, client6, client7, client8  exit to ip.public.no.2
> client9, client10, client11, client12  exit to ip.public.no.3
> ........
> ........
> client ip address 192.168.1.1 - 192.168.1.50
> public ip address 202.47.12.30 - 202.47.12.45
>
> any one can help ?
> i have installed redhat7.2 for server

iptables -A POSTROUTING -t nat -s 192.168.1.0/30 -j SNAT --to 202.47.12.30
iptables -A POSTROUTING -t nat -s 192.168.1.4/30 -j SNAT --to 202.47.12.31
iptables -A POSTROUTING -t nat -s 192.168.1.8/30 -j SNAT --to 202.47.12.32
iptables -A POSTROUTING -t nat -s 192.168.1.12/30 -j SNAT --to 202.47.12.33

etc.

Antony.

-- 

If at first you don't succeed, destroy all the evidence that you tried.

multiple SNAT

[Askar]

hi,
we have a netfilter iptables base gateway (NATing), doing SNAT.

interfaces

eth0: public ip + single alias for RFC 1918 (192.168.1.x)
eth1: 192.168.50.3 (pvt) 

Our web,mail server also have  192.168.50.x subnet ips

Now I want to SNAT the traffic to companies web server and mail via
eth1 and the rest (Internet) via eth0.
we are also MARKing port 80 traffic to send for our cache /proxy server.

Portion from the iptables ruleset.

#echo 200 cache.out >> /etc/iproute2/rt_tables
#ip rule add fwmark 1 table cache.out
#ip route add default via xxx.xxx.xxx.xx dev eth0 table cache.out
#ip route flush cache
############Ip Tables Mangle For Above Rule####################
# Mark all port 80
iptables -A PREROUTING -i eth0 -t mangle -p tcp --dport 80 -j MARK --set-mark 1

# re mark port 80 towards company web server that by passing cache/server
iptables -A PREROUTING -i eth0 -t mangle -p tcp -d xxx.xxx.xxx.xx -j
MARK --set-mark 2

# marking mail traffic to company mail server
iptables -A PREROUTING -i eth0 -t mangle -p tcp -d xxx.xxx.xxx.xx -j
MARK --set-mark 2
#


Regards

Askar Ali

-- 
I love deadlines. I like the whooshing sound they make as they fly by.
Douglas Adams

Re: multiple SNAT

[Ing. Rogelio Sevilla Fernandez]

I think you could get work that only using a static route to your servers on
192.168.50.x network via eth1




Quoting Askar <askarali@gmail.com>:

> hi,
> we have a netfilter iptables base gateway (NATing), doing SNAT.
>
> interfaces
>
> eth0: public ip + single alias for RFC 1918 (192.168.1.x)
> eth1: 192.168.50.3 (pvt)
>
> Our web,mail server also have  192.168.50.x subnet ips
>
> Now I want to SNAT the traffic to companies web server and mail via
> eth1 and the rest (Internet) via eth0.
> we are also MARKing port 80 traffic to send for our cache /proxy server.
>
> Portion from the iptables ruleset.
>
> #echo 200 cache.out >> /etc/iproute2/rt_tables
> #ip rule add fwmark 1 table cache.out
> #ip route add default via xxx.xxx.xxx.xx dev eth0 table cache.out
> #ip route flush cache
> ############Ip Tables Mangle For Above Rule####################
> # Mark all port 80
> iptables -A PREROUTING -i eth0 -t mangle -p tcp --dport 80 -j MARK 
> --set-mark 1
>
> # re mark port 80 towards company web server that by passing cache/server
> iptables -A PREROUTING -i eth0 -t mangle -p tcp -d xxx.xxx.xxx.xx -j
> MARK --set-mark 2
>
> # marking mail traffic to company mail server
> iptables -A PREROUTING -i eth0 -t mangle -p tcp -d xxx.xxx.xxx.xx -j
> MARK --set-mark 2
> #
>
>
> Regards
>
> Askar Ali
>
> --
> I love deadlines. I like the whooshing sound they make as they fly by.
> Douglas Adams
>
>
>



----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.