From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Martin A. Brown" Date: Sun, 02 Mar 2003 17:56:58 +0000 Subject: [LARTC] NAT: multiple route lookups; local use of NAT IP Message-Id: List-Id: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: lartc@vger.kernel.org Hello all, Part I - - - - - - I am using a stateless (iproute2) NAT installation here as a concrete example around which to ask my question about cases where route lookups are required. I do not understand the entire sequence of route lookups required. Intuition and observation suggest to me that there have to be two separate route lookups. I would like confirmation and/or further explanation, if possible. Here's a simple map describing my working configuration. +---------+ 10.17.0.0/16 | NAT | 172.17.0.0/16 -----------------+ router +-------------------- eth2 +---------+ eth3 Here's my current understanding: 1 packet arrives from 192.168.14.2 on eth2 bound for 10.17.254.1 2 route exists in local routing table; rewrite packet for 172.17.254.1 3 ?? 4 rewritten packet is transmitted on eth3 to 172.31.254.1 It seems that there must be a route lookup for 172.17.254.1 at step 3. How does the kernel know to perform a second lookup? Under what other situations would there be multiple route lookups for the same packet? Part II - - - - - - Of less importance to me, but a peculiar side effect of the stateless NAT, I find that I can never connect to IPs configured for NAT on the box in question. These commands were run on the NAT router in the above diagram. # ping -n 10.17.254.1 connect: Invalid argument # ping -I 192.168.0.13 -n 10.17.254.1 PING 10.17.254.1 (10.17.254.1) from 192.168.0.13 : 56(84) bytes of data. ping: sendto: Invalid argument ping: sendto: Invalid argument --- 10.17.254.1 ping statistics --- 2 packets transmitted, 0 packets received, 100% packet loss Is this a side effect of the NAT entry in the local routing table? Thank you in advance for any answers, -Martin Notes: - - - - - - - - - - - - - - there are more interface on the box, but no traffic relevant to my question traverses any of these interfaces - aside from the NAT entry, there are no RPDB entries - # ip rule show | grep 10.17 310: from 172.17.0.0/16 to 10.10.0.0/16 lookup main map-to 10.17.0.0 - # ip route show table local | grep '^nat 10.17' nat 10.17.0.0/16 via 172.17.0.0 scope host routing cache entries - - - - - - - - - - - - - 192.168.14.2 from 172.17.254.1 via 192.168.0.251 dev eth2 src 172.31.254.254 cache mtu 1500 rtt 300 iif eth3 10.17.254.1 from 192.168.14.2 via 172.31.254.1 dev eth3 src 192.168.0.13 cache mtu 1500 rtt 300 iif eth2 -- Martin A. Brown --- SecurePipe, Inc. --- mabrown@securepipe.com _______________________________________________ LARTC mailing list / LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/