[LARTC] multiple uplinks/iptables -t nat -PREROUTING funny

From: Russell Senior <seniorr@aracnet.com>
To: lartc@vger.kernel.org
Subject: [LARTC] multiple uplinks/iptables -t nat -PREROUTING funny
Date: Fri, 11 Apr 2003 07:57:54 +0000	[thread overview]
Message-ID: <marc-lartc-105004797308651@msgid-missing> (raw)

I have a network much like that show in:

  <http://www.lartc.org/howto/lartc.rpdb.multiple-links.html>

with a few wrinkles.  This is with a ptrace patched 2.4.20 kernel.

The wrinkles are that one interface has 14 IPs (.2 to .15) total (via
eth1 and aliasing), the other being a single DHCP-provided IP (eth0).

I have a iptables rule:

  /sbin/iptables -t nat -A PREROUTING -i eth1 -d eee.fff.ggg.11 -p tcp --dport 22 -j DNAT --to 192.168.0.2:22

That's all there is (currently) in the PREROUTING iptable.
POSTROUTING has:

  /sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
  /sbin/iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

When I connect from the outside to eee.fff.ggg.11:22, I never hear a
reply.  Ethereal (on the internal interface, eth2) shows replies, but
looking on the other external interface (eth0) it appears that the
replies are all shooting out of it (the default path).  Nothing ever
returns out the eth1 interface as it "should".  I have the ip rules
set up as follows:

   # ip rule show
   0:      from all lookup local 
   32757:  from aaa.bbb.ccc.ddd lookup T1
   32758:  from eee.fff.ggg.2/31 lookup T2  # note the 3 rules are to cover
   32759:  from eee.fff.ggg.4/30 lookup T2  # the .2 to .15 IP space
   32760:  from eee.fff.ggg.8/29 lookup T2 
   32766:  from all lookup main 
   32767:  from all lookup default 

   # ip route show table T1
   192.168.0.0/24 dev eth2  scope link 
   default via aaa.bbb.ccc.1 dev eth0 

   # ip route show table T2
   eee.fff.ggg.1 dev eth1  scope link 
   eee.fff.ggg.0/28 dev lo  scope link 
   192.168.0.0/24 dev eth2  scope link 
   default via eee.fff.ggg.1 dev eth1 

   x# ip route    # (default rule)
   eee.fff.ggg.1 dev eth1  scope link 
   eee.fff.ggg.0/28 dev lo  scope link 
   192.168.0.0/24 dev eth2  proto kernel  scope link  src 192.168.0.1 
   eee.fff.ggg.0/24 dev eth1  proto kernel  scope link  src eee.fff.ggg.10 
   aaa.bbb.ccc.0/23 dev eth0  proto kernel  scope link  src aaa.bbb.ccc.ddd
   default via aaa.bbb.ccc.1 dev eth0 

When I connect to the port forwarded address from the outside, it
looks like the returning packets are getting routed _before_ the
source IP is translated (and thus aren't matching a special rule and
thus get routed according to the default rule).  Everything else seems
to be working fine. 

Has anyone seen this?  Is it a bug or am I just confused?

-- 
Russell Senior         ``I've seen every kind of critter God ever made,
seniorr@aracnet.com      and I ain't never seen a meaner, lower, more
                         stinkin' yellow hypocrite than you!'' 
                                        -- Burl Ives as Rufus Hennessy
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/