[LARTC] DNAT rare problem...

[LARTC] DNAT rare problem...

[ThE PhP_kiD]

Hi!

I've the next network:

                        inet
                          |
                          |
                          | 20.5.90.194/26
                          | 20.5.90.195/26
                ---------------------
                |        eth0       |
                |                   |
                |  internet gateway |
                |                   |
                |        eth1       |
                ---------------------
                          | 192.168.100.254/24
                          | 192.168.210.254/24
                          |
       +------------------+-----+----------------+
       |                        |                |
       | 192.168.100.1/24       | 192.168.210.1  | 
       |                        |                |192.168.210.2
--------------          +------------+       +--------+
|   eth0     |          |   host 1   |       | host 2 |
| SENDMAIL   |          +------------+       +--------+
--------------
                        

The internet gateway is a linux 2.4.21 with iptables 1.2.8
On eth0, it haves two IPs public:
        20.5.90.194/26
        20.5.90.195/26

Since I can't to route last public IPs, and I need to run
a Sendmail server that can be visible from internet, I have maked
a DNAT rule, (and some SNAT rules too, in order to provide
internet access to LAN)

# iptables -L -t nat -n  

give me the next:

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
DNAT       all  --  0.0.0.0/0            200.5.90.195       to:192.168.100.1
ACCEPT     all  --  192.168.100.1        0.0.0.0/0
ACCEPT     all  --  192.168.210.1        0.0.0.0/0
ACCEPT     all  --  192.168.210.2        0.0.0.0/0
DROP       all  --  0.0.0.0/0            0.0.0.0/0

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  0.0.0.0/0            192.168.100.0/24
SNAT       all  --  192.168.100.1        0.0.0.0/0          to:20.5.90.195
SNAT       all  --  192.168.210.1        0.0.0.0/0          to:20.5.90.194
SNAT       all  --  192.168.210.2        0.0.0.0/0          to:20.5.90.194


Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

From Internet (wan site), I can reach without problems the Sendmail server
host, making ping to 20.5.90.195, and open port 25.

From Lan side (hosts 192.168.102.1 or 192.168.102.2), I can ping to 20.5.90.195
but I can't to open port 25... 

(but sometimes, I can do it !!)   

What happen ????????

Thank you very very much in advance.
Mac

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] DNAT rare problem...

[Martin A. Brown]

Hello there Mac,

[ nicely drawn map snipped ]

[ succinct NAT tables snipped ]

 : From Internet (wan site), I can reach without problems the Sendmail
 : server host, making ping to 20.5.90.195, and open port 25.

Seems correct.

 : From Lan side (hosts 192.168.102.1 or 192.168.102.2), I can ping to
 : 20.5.90.195 but I can't to open port 25...

Interesting.  I wouldn't expect that to work at all.

 : (but sometimes, I can do it !!)

Even more interesting....

Is the linux NAt/masq router perhaps not suppressing ICMP redirects?

 : What happen ????????

I'd suggest using DNAT for packets on the way in from the internal network
(your existing rules should take care of this), and using SNAT for packets
destined for the sendmail box from the internal network.

  iptables -t nat -s 192.168.102.0/24 -d 20.5.90.195 -p tcp --dport 25 \
    -j SNAT --to-source 192.168.100.254

-Martin

P.S., A far better solution would be to use split-horizon DNS and have the
      internal hosts connect to the private IP address.


-- 
Martin A. Brown --- SecurePipe, Inc. --- mabrown@securepipe.com

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/