From: Arkadiusz Miskiewicz <misiek@pld.org.pl>
To: lartc@vger.kernel.org
Subject: [LARTC] ip rule and DNAT
Date: Fri, 20 Jun 2003 22:14:07 +0000 [thread overview]
Message-ID: <marc-lartc-105615882008170@msgid-missing> (raw)
In-Reply-To: <marc-lartc-105614737400520@msgid-missing>
My setup looks like this
1inet---(yy.yy.186.12)router---network 172.16.0.0/16
(xx.xx.251.73)
|
|
2inet
Router is doing masquerade. There was one link to internet. I need
to connect to some host in 172.16.0.0 network so I'm doing DNAT.
That was working quite well until second link to internet was added.
After adding ip rule to allow using both internet connections
from outside DNAT stopped working.
[root@osrodek root]# ip rule
0: from all lookup local
32764: from yy.yy.186.12 lookup 10
32765: from all lookup main
32766: from all lookup main
32767: from all lookup default
[root@osrodek root]# ip route show table main
[...]
172.16.100.2 dev eth1 proto kernel scope link src 172.16.100.1
172.16.0.0/12 via 172.16.100.2 dev eth1
default via xx.xx.251.73 dev eth0 onlink
[root@osrodek root]# ip route show table 10
default via yy.yy.186.254 dev eth0
table main is used for routing through 2inet connection while
table 10 is used for routing through 1inet connection.
DNAT rules:
[root@osrodek root]# iptables -L -n -t nat | grep ":22"
DNAT tcp --- 0.0.0.0/0 xx.xx.251.74 tcp dpt:11022 to:172.16.100.4:22
DNAT tcp --- 0.0.0.0/0 xx.xx.251.74 tcp dpt:12022 to:172.16.100.2:22
DNAT tcp --- 0.0.0.0/0 xx.xx.251.74 tcp dpt:10022 to:172.16.2.254:22
DNAT tcp --- 0.0.0.0/0 yy.yy.186.12 tcp dpt:11022 to:172.16.100.4:22
DNAT tcp --- 0.0.0.0/0 yy.yy.186.12 tcp dpt:12022 to:172.16.100.2:22
DNAT tcp --- 0.0.0.0/0 yy.yy.186.12 tcp dpt:10022 to:172.16.2.254:22
When I connect to ie. xx.xx.251.74:11022 or yy.yy.186.12:11022 then
I just get timeout. Packets seems not comming back :/ Without ip rules
everything works fine (but I can use only one inet connection then)
Any ideas?
--
Arkadiusz Mi¶kiewicz CS at FoE, Wroclaw University of Technology
arekmatssedotpl AM2-6BONE, 1024/3DB19BBD, arekm(at)ircnet, PLD/Linux
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
prev parent reply other threads:[~2003-06-20 22:14 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2003-06-20 22:14 [LARTC] ip rule and DNAT Arkadiusz Miskiewicz
2003-06-20 22:14 ` Arkadiusz Miskiewicz [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=marc-lartc-105615882008170@msgid-missing \
--to=misiek@pld.org.pl \
--cc=lartc@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.