* Re: [LARTC] Routing private and non-private ips
2002-07-15 19:32 [LARTC] Routing private and non-private ips Lucky
@ 2002-07-16 18:19 ` Martin A. Brown
2002-07-17 15:15 ` Lukas Kolbe
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: Martin A. Brown @ 2002-07-16 18:19 UTC (permalink / raw)
To: lartc
Lucky,
If I understand correctly what you are trying to do, it is simple static
network address translation. The following commands should give you
static NAT.
Choose an IP in your /29 and make it the public IP. Choose an IP in the
internal rfc 1918 network and make it the private IP. Now try the
following:
ip route add nat pu.bl.ic.ip via pr.iv.at.ip
ip rule add nat pu.bl.ic.ip from pr.iv.at.ip prio $PRIO
ip route flush cache
As for the packet filtering, you'll have to make a second set of rules.
You'll need to allow the packet from outside to the public IP and you'll
need to add a second set of rules to allow the packet from outside to the
private IP.
Good luck,
-Martin
On Mon, 15 Jul 2002, Lucky wrote:
: Hi folks!
:
: I have a little problem here, probably not related to LAR and surely not to
: TC, but I don't know somebody else to ask.
:
: The scenario is as follows:
:
: Router R has two connections to the internet (ippp3, static IP-Address with
: and a /29er network N1 routed to, and ppp0, dynamic IP-Address), one to the
: local network N2 (eth0).
: Currently, R does the following:
:
: - masqerades all connections from N2 to the Internet
: - policy-routes packets originating from connections from ippp3 back to ippp3
: - firewalls
:
: Now I'd like to give a Host H1 in N2 a local, private IP-Address _and_ a
: public, non-private IP-Address from our /29-net.
:
: How would I do the routing?
: I tried routing the /29-net through eth0, which lets me ping R to H1, but not
: vice-versa. The routing from the internet to H1 and vice-versa also didn't
: work.
: I allowed nearly everything to and from the /29-net in all of the input,
: forward and output-chains (I'm currently using Linux 2.2.20).
:
: Any help would be really appreciated.
:
: Please Cc' me on answers, cause I'm getting the list only in digest-mode.
:
:
--
Martin A. Brown --- SecurePipe, Inc. --- mabrown@securepipe.com
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [LARTC] Routing private and non-private ips
2002-07-15 19:32 [LARTC] Routing private and non-private ips Lucky
2002-07-16 18:19 ` Martin A. Brown
@ 2002-07-17 15:15 ` Lukas Kolbe
2002-07-17 17:18 ` Martin A. Brown
2002-07-19 18:29 ` Lukas Kolbe
3 siblings, 0 replies; 5+ messages in thread
From: Lukas Kolbe @ 2002-07-17 15:15 UTC (permalink / raw)
To: lartc
Am Mit, 2002-07-17 um 00.37 schrieb lartc-request@mailman.ds9a.nl:
> From: Martin A. Brown <mabrown-lartc@securepipe.com>
> To: Lucky <lucky@knup.de>
> Cc: lartc@mailman.ds9a.nl
> Subject: Re: [LARTC] Routing private and non-private ips
> Date: 16 Jul 2002 13:19:19 -0500
>
> Lucky,
>
> If I understand correctly what you are trying to do, it is simple static
> network address translation. The following commands should give you
> static NAT.
Well, that sounds quite good :)
I first got an "RTNETLINK answers: Invalid argument", but D'oh, it was the wrong
shell ;)
> Choose an IP in your /29 and make it the public IP. Choose an IP in the
> internal rfc 1918 network and make it the private IP. Now try the
> following:
>
> ip route add nat pu.bl.ic.ip via pr.iv.at.ip
> ip rule add nat pu.bl.ic.ip from pr.iv.at.ip prio $PRIO
> ip route flush cache
A big thant you, this works so far. I thought that I could give a public
IP to one of the NICs in the Server here, an it would be routed directly
to, but this is also very nice.
I think it works partially now.
If I do a traceroute from a pc on the internet, it goes on up to the
router and stops there.
If I ping the NATed IP from the router, I get:
moria2:~# ping x.x.x.42
ping: sendto: Invalid argument
ping: wrote x.x.x.42 64 chars, ret=-1
Ping to the private one just works fine:
moria2:~# ping 192.168.2.206
PING 192.168.2.206 (192.168.2.206): 56 data bytes
64 bytes from 192.168.2.206: icmp_seq=0 ttld time=0.5 ms
Well, there comes something to my mind: All of the 192.168.2.0/24 gets
masq'ed to the internet on the router. I think I somehow have to exclude
192.168.2.206 (the pr.iv.at.ip) from the masq'ing, right?
Or is the best solution to put the to-be-NATed server in another subnet
(192.168.4.0/24) for example?
> As for the packet filtering, you'll have to make a second set of rules.
>
> You'll need to allow the packet from outside to the public IP and you'll
> need to add a second set of rules to allow the packet from outside to the
> private IP.
>
> Good luck,
>
> -Martin
>
--
Lucky
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [LARTC] Routing private and non-private ips
2002-07-15 19:32 [LARTC] Routing private and non-private ips Lucky
2002-07-16 18:19 ` Martin A. Brown
2002-07-17 15:15 ` Lukas Kolbe
@ 2002-07-17 17:18 ` Martin A. Brown
2002-07-19 18:29 ` Lukas Kolbe
3 siblings, 0 replies; 5+ messages in thread
From: Martin A. Brown @ 2002-07-17 17:18 UTC (permalink / raw)
To: lartc
Lucky,
: Well, there comes something to my mind: All of the 192.168.2.0/24 gets
: masq'ed to the internet on the router. I think I somehow have to exclude
: 192.168.2.206 (the pr.iv.at.ip) from the masq'ing, right?
: Or is the best solution to put the to-be-NATed server in another subnet
: (192.168.4.0/24) for example?
Perhaps you could insert a new rule with ipchains or iptables.
So, you have something in your chains rules that looks like this:
ipchains -A forward -s 192.168.2.0/24 -d 0/0 -j MASQ
Simply insert a special case:
ipchains -I forward 1 -s 192.168.2.206 -d 0/0 -j ACCEPT
Then the packet will not be masqueraded and will be handled by whatever
other packet mangling rules you have (in particular, it will be NAT'd
by the rule policy database). To verify that the RPDB has the rules you
inserted, try this (your output should look similar to this; filled in
with the correct pu.bl.ic.ip, of course):
# ip rule show
0: from all lookup local
32765: from 192.168.2.206 lookup main map-to pu.bl.ic.ip
32766: from all lookup main
32767: from all lookup 253
# ip route show table all | grep nat
nat pu.bl.ic.ip via 192.168.2.206 table local scope host
Rules in both iptables and ipchains are handled sequentially, so you want
to create the more specific chains rules first and then the more general.
This prevents the general rule from matching before the specific rule is
used.
Freundliche grüsse,
-Martin
--
Martin A. Brown --- SecurePipe, Inc. --- mabrown@securepipe.com
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [LARTC] Routing private and non-private ips
2002-07-15 19:32 [LARTC] Routing private and non-private ips Lucky
` (2 preceding siblings ...)
2002-07-17 17:18 ` Martin A. Brown
@ 2002-07-19 18:29 ` Lukas Kolbe
3 siblings, 0 replies; 5+ messages in thread
From: Lukas Kolbe @ 2002-07-19 18:29 UTC (permalink / raw)
To: lartc
Am Mit, 2002-07-17 um 19.18 schrieb Martin A. Brown:
> Lucky,
> So, you have something in your chains rules that looks like this:
> ipchains -A forward -s 192.168.2.0/24 -d 0/0 -j MASQ
> Simply insert a special case:
> ipchains -I forward 1 -s 192.168.2.206 -d 0/0 -j ACCEPT
OK, now I have in the firewall:
Chain input (policy DENY):
target prot opt source destination ports
[ipac and lo rules]
ACCEPT all ------ 0.0.0.0/0 pu.bl.ic.ip n/a
[rest]
Chain forward (policy DENY):
target prot opt source destination
ports
ACCEPT all ------ 0.0.0.0/0 192.168.2.206 n/a
ACCEPT all ------ 192.168.2.206 0.0.0.0/0 n/a
[masq`ing stuff]
Chain output (policy DENY):
target prot opt source destination
ports
[ipac]
ACCEPT all ------ 0.0.0.0/0 0.0.0.0/0 n/a
ACCEPT all ------ 192.168.2.206 0.0.0.0/0 n/a
[rest]
and the routing is as follows:
moria2:/etc/ipmasq/rules# ip rule ls
0: from all lookup local
320: from 192.168.2.206 lookup public.ip
32763: from is.dn.if.ip lookup isdn
32766: from all lookup main
32767: from all lookup default
moria2:/etc/ipmasq/rules# ip route show table public.ip
nat pu.bl.ic.ip via 192.168.2.206 scope host
default dev ippp3 scope link
moria2:/etc/ipmasq/rules# ip route show table isdn
default via is.dn.peer.ip dev ippp3
I have a problem with the public.ip-table:
normally, like in the lartc-howto, one does
ip route add default via is.dn.peer.ip dev ippp3 table public.ip
this actually works for table isdn (right after dial-up), but when I do
this for table public.ip I get:
RTNETLINK answers: Network is unreachable
The ISDN-Peer is in another subnet (x.x.32.121) than our address-space
(x.x.35.40/29), maybe that does matter.
I hope somebody can help me there. If not, I'm just going on and try
things out :)
Maybe it is a Kernel-Problem, or such. I'm using 2.2.20, perhaps I have
to use the lates 2.4?
--
Lucky
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
^ permalink raw reply [flat|nested] 5+ messages in thread