[LARTC] masq + nat + port forwarding: can it be done?

[Ben <bench@silentmedia.com>]

We're having problems getting our 2.4 kernel to do exactly what we need
it to for our network. In short, we aren't able to do port forwarding for
a masquarded machine, nor for a NAT'd machine.

The topology goes like:

cable -- (eth2) 
           |
          router - (eth1)
           |           |
dsl ---- (eth0)        +-- client1 (10.0.0.1)
                       +-- client2 (10.0.0.2)
                       +-- server1 (10.0.0.3)
                       +-- server2 (10.0.0.4)

The router's interfaces are:
eth0    1.1.1.1
eth0:1  1.1.1.2
eth1    10.0.0.254
eth2    2.2.2.2


server1 (10.0.0.3) is set up for 1:1 NAT with eth0:1... all incoming
packets to 1.1.1.2 go to server1, and all packets from server1 get
translated to come from 1.1.1.2.

client1 and client2 are masquaraded through eth0, unless they
attempt to initiate an ftp or nntp connection, in which case they are
masq'd through eth2.

server2 is always masq'd through eth2.

What we'd *like* to do is the following:

1) If ftp connections come in on eth2, we'd like to forward those requests
on to server2, and have replies go back out the same interface. It's not
clear to me if it's even possible to set up port forwarding for an
interface that's doing masquarading, much less what the iptables syntax.

2) If ssh connections come in on eth0:1, we'd like to forward those
requests on to client2 (instead of server1), and also have client2's
replies leave through eth0:1... but ONLY if we're talking about ssh
packets. Basically, this is 1:1 NAT for eth0:1 and server1, except for
ssh, where we'll want to do 1:1 NAT with a differnt internal IP. The
problem I'm having with this is how to specify the reverse route? client2
should be masq'd by eth0, unless it's responding to ssh packets coming
from eth0:1.

Help?


_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://ds9a.nl/2.4Routing/