Re: [LARTC] Routing private and non-private ips

["Martin A. Brown" <mabrown-lartc@securepipe.com>]

Lucky,

 : Well, there comes something to my mind: All of the 192.168.2.0/24 gets
 : masq'ed to the internet on the router. I think I somehow have to exclude
 : 192.168.2.206 (the pr.iv.at.ip) from the masq'ing, right?
 : Or is the best solution to put the to-be-NATed server in another subnet
 : (192.168.4.0/24) for example?

Perhaps you could insert a new rule with ipchains or iptables.

So, you have something in your chains rules that looks like this:

  ipchains -A forward  -s 192.168.2.0/24 -d 0/0 -j MASQ

Simply insert a special case:

  ipchains -I forward 1 -s 192.168.2.206 -d 0/0 -j ACCEPT

Then the packet will not be masqueraded and will be handled by whatever 
other packet mangling rules you have (in particular, it will be NAT'd 
by the rule policy database).  To verify that the RPDB has the rules you 
inserted, try this (your output should look similar to this; filled in 
with the correct pu.bl.ic.ip, of course):

# ip rule show
0:      from all lookup local
32765:  from 192.168.2.206 lookup main map-to pu.bl.ic.ip
32766:  from all lookup main 
32767:  from all lookup 253
# ip route show table all | grep nat
nat pu.bl.ic.ip via 192.168.2.206 table local scope host

Rules in both iptables and ipchains are handled sequentially, so you want 
to create the more specific chains rules first and then the more general.  
This prevents the general rule from matching before the specific rule is 
used.

Freundliche grüsse,

-Martin

-- 
Martin A. Brown --- SecurePipe, Inc. --- mabrown@securepipe.com



_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/