[LARTC] Routing private and non-private ips

[LARTC] Routing private and non-private ips

[Lucky]

Hi folks!

I have a little problem here, probably not related to LAR and surely not to 
TC, but I don't know somebody else to ask.

The scenario is as follows:

Router R has two connections to the internet (ippp3, static IP-Address with 
and a /29er network N1 routed to, and ppp0, dynamic IP-Address), one to the 
local network N2 (eth0).
Currently, R does the following:

- masqerades all connections from N2 to the Internet
- policy-routes packets originating from connections from ippp3 back to ippp3
- firewalls

Now I'd like to give a Host H1 in N2 a local, private IP-Address _and_ a
public, non-private IP-Address from our /29-net.

How would I do the routing?
I tried routing the /29-net through eth0, which lets me ping R to H1, but not
vice-versa. The routing from the internet to H1 and vice-versa also didn't
work.
I allowed nearly everything to and from the /29-net in all of the input, 
forward and output-chains (I'm currently using Linux 2.2.20).

Any help would be really appreciated.

Please Cc' me on answers, cause I'm getting the list only in digest-mode.

-- 
Lukas
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] Routing private and non-private ips

[Martin A. Brown]

Lucky,

If I understand correctly what you are trying to do, it is simple static 
network address translation.  The following commands should give you 
static NAT.

Choose an IP in your /29 and make it the public IP.  Choose an IP in the 
internal rfc 1918 network and make it the private IP.  Now try the 
following:

  ip route add nat pu.bl.ic.ip via pr.iv.at.ip
  ip rule add nat pu.bl.ic.ip from pr.iv.at.ip prio $PRIO
  ip route flush cache

As for the packet filtering, you'll have to make a second set of rules.

You'll need to allow the packet from outside to the public IP and you'll 
need to add a second set of rules to allow the packet from outside to the 
private IP.

Good luck,

-Martin

On Mon, 15 Jul 2002, Lucky wrote:

 : Hi folks!
 : 
 : I have a little problem here, probably not related to LAR and surely not to 
 : TC, but I don't know somebody else to ask.
 : 
 : The scenario is as follows:
 : 
 : Router R has two connections to the internet (ippp3, static IP-Address with 
 : and a /29er network N1 routed to, and ppp0, dynamic IP-Address), one to the 
 : local network N2 (eth0).
 : Currently, R does the following:
 : 
 : - masqerades all connections from N2 to the Internet
 : - policy-routes packets originating from connections from ippp3 back to ippp3
 : - firewalls
 : 
 : Now I'd like to give a Host H1 in N2 a local, private IP-Address _and_ a
 : public, non-private IP-Address from our /29-net.
 : 
 : How would I do the routing?
 : I tried routing the /29-net through eth0, which lets me ping R to H1, but not
 : vice-versa. The routing from the internet to H1 and vice-versa also didn't
 : work.
 : I allowed nearly everything to and from the /29-net in all of the input, 
 : forward and output-chains (I'm currently using Linux 2.2.20).
 : 
 : Any help would be really appreciated.
 : 
 : Please Cc' me on answers, cause I'm getting the list only in digest-mode.
 : 
 : 

-- 
Martin A. Brown --- SecurePipe, Inc. --- mabrown@securepipe.com



_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] Routing private and non-private ips

[Lukas Kolbe]

Am Mit, 2002-07-17 um 00.37 schrieb lartc-request@mailman.ds9a.nl:

> From: Martin A. Brown <mabrown-lartc@securepipe.com>
> To: Lucky <lucky@knup.de>
> Cc: lartc@mailman.ds9a.nl
> Subject: Re: [LARTC] Routing private and non-private ips
> Date: 16 Jul 2002 13:19:19 -0500
> 
> Lucky,
> 
> If I understand correctly what you are trying to do, it is simple static 
> network address translation.  The following commands should give you 
> static NAT.

Well, that sounds quite good :)
I first got an "RTNETLINK answers: Invalid argument", but D'oh, it was the wrong 
shell ;)

> Choose an IP in your /29 and make it the public IP.  Choose an IP in the 
> internal rfc 1918 network and make it the private IP.  Now try the 
> following:
> 
>   ip route add nat pu.bl.ic.ip via pr.iv.at.ip
>   ip rule add nat pu.bl.ic.ip from pr.iv.at.ip prio $PRIO
>   ip route flush cache

A big thant you, this works so far. I thought that I could give a public
IP to one of the NICs in the Server here, an it would be routed directly
to, but this is also very nice.

I think it works partially now.
If I do a traceroute from a pc on the internet, it goes on up to the
router and stops there.
If I ping the NATed IP from the router, I get:

moria2:~# ping x.x.x.42
ping: sendto: Invalid argument
ping: wrote x.x.x.42 64 chars, ret=-1

Ping to the private one just works fine:

moria2:~# ping 192.168.2.206
PING 192.168.2.206 (192.168.2.206): 56 data bytes
64 bytes from 192.168.2.206: icmp_seq=0 ttld time=0.5 ms


Well, there comes something to my mind: All of the 192.168.2.0/24 gets
masq'ed to the internet on the router. I think I somehow have to exclude
192.168.2.206 (the pr.iv.at.ip) from the masq'ing, right?
Or is the best solution to put the to-be-NATed server in another subnet
(192.168.4.0/24) for example?


> As for the packet filtering, you'll have to make a second set of rules.
> 
> You'll need to allow the packet from outside to the public IP and you'll 
> need to add a second set of rules to allow the packet from outside to the 
> private IP.
> 
> Good luck,
> 
> -Martin
> 


-- 
Lucky

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] Routing private and non-private ips

[Martin A. Brown]

Lucky,

 : Well, there comes something to my mind: All of the 192.168.2.0/24 gets
 : masq'ed to the internet on the router. I think I somehow have to exclude
 : 192.168.2.206 (the pr.iv.at.ip) from the masq'ing, right?
 : Or is the best solution to put the to-be-NATed server in another subnet
 : (192.168.4.0/24) for example?

Perhaps you could insert a new rule with ipchains or iptables.

So, you have something in your chains rules that looks like this:

  ipchains -A forward  -s 192.168.2.0/24 -d 0/0 -j MASQ

Simply insert a special case:

  ipchains -I forward 1 -s 192.168.2.206 -d 0/0 -j ACCEPT

Then the packet will not be masqueraded and will be handled by whatever 
other packet mangling rules you have (in particular, it will be NAT'd 
by the rule policy database).  To verify that the RPDB has the rules you 
inserted, try this (your output should look similar to this; filled in 
with the correct pu.bl.ic.ip, of course):

# ip rule show
0:      from all lookup local
32765:  from 192.168.2.206 lookup main map-to pu.bl.ic.ip
32766:  from all lookup main 
32767:  from all lookup 253
# ip route show table all | grep nat
nat pu.bl.ic.ip via 192.168.2.206 table local scope host

Rules in both iptables and ipchains are handled sequentially, so you want 
to create the more specific chains rules first and then the more general.  
This prevents the general rule from matching before the specific rule is 
used.

Freundliche grüsse,

-Martin

-- 
Martin A. Brown --- SecurePipe, Inc. --- mabrown@securepipe.com



_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] Routing private and non-private ips

[Lukas Kolbe]

Am Mit, 2002-07-17 um 19.18 schrieb Martin A. Brown:
> Lucky,

> So, you have something in your chains rules that looks like this:
>   ipchains -A forward  -s 192.168.2.0/24 -d 0/0 -j MASQ
> Simply insert a special case:
>   ipchains -I forward 1 -s 192.168.2.206 -d 0/0 -j ACCEPT

OK, now I have in the firewall:

Chain input (policy DENY):
target     prot opt     source               destination           ports
[ipac and lo rules]
ACCEPT     all  ------  0.0.0.0/0            pu.bl.ic.ip           n/a
[rest]

Chain forward (policy DENY):
target     prot opt     source                destination          
ports
ACCEPT     all  ------  0.0.0.0/0            192.168.2.206         n/a
ACCEPT     all  ------  192.168.2.206        0.0.0.0/0             n/a
[masq`ing stuff]

Chain output (policy DENY):
target     prot opt     source                destination          
ports
[ipac]
ACCEPT     all  ------  0.0.0.0/0            0.0.0.0/0             n/a
ACCEPT     all  ------  192.168.2.206        0.0.0.0/0             n/a
[rest]


and the routing is as follows:

moria2:/etc/ipmasq/rules# ip rule ls
0:	from all lookup local 
320:	from 192.168.2.206 lookup public.ip 
32763:	from is.dn.if.ip lookup isdn 
32766:	from all lookup main 
32767:	from all lookup default 

moria2:/etc/ipmasq/rules# ip route show table public.ip
nat pu.bl.ic.ip via 192.168.2.206  scope host 
default dev ippp3  scope link 

moria2:/etc/ipmasq/rules# ip route show table isdn     
default via is.dn.peer.ip dev ippp3 


I have a problem with the public.ip-table:
normally, like in the lartc-howto, one does 

ip route add default via is.dn.peer.ip dev ippp3 table public.ip

this actually works for table isdn (right after dial-up), but when I do
this for table public.ip I get:

RTNETLINK answers: Network is unreachable

The ISDN-Peer is in another subnet (x.x.32.121) than our address-space
(x.x.35.40/29), maybe that does matter.


I hope somebody can help me there. If not, I'm just going on and try
things out :)

Maybe it is a Kernel-Problem, or such. I'm using 2.2.20, perhaps I have
to use the lates 2.4?


-- 
Lucky

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/