[LARTC] Policy Routing and NAT

[LARTC] Policy Routing and NAT

[Robert Felber]

[-- Attachment #1: Type: text/plain, Size: 1681 bytes --]

Hi, 

is there an issue with policy-routing and/or NAT?
I've been trying for months now to DNAT a host in a LAN.
The router has 3 NICs, 2 of them are connected to a) the internet
and b) an extranet. Now a host XYZ is visible with a unique IP on
both, the internet and extranet. I'll give you a little tcpdump fragment:
(eth0: inet, eth1: LAN, eth2: secured internet (extranet))
network 62.156.190. not administrable (t-systems).

eth0 < 62.156.190.37.48495 > 62.225.182.35.http
eth1 > 62.156.190.37.48495 > 192.168.0.3.http
eth1 < 192.168.0.3.http > 62.156.190.37.48495
eth2 > 62.225.182.35.http > 62.156.190.37.48495

as you can see, the packet leaves the wrong device.
I've already tried iproute2 rules like:

$IP route add table 2 via $INET_ROUTER dev eth0
$IP rule add from 62.225.182.32/29 lookup 2


also i don't understand why the router NATs it with 62.225.182.35 when
the postrouting rule is:

$IPTABLES -t nat -A POSTROUTING -o eth0 -s 192.168.0.3 \
 -j SNAT --to-source 62.225.182.35

(if you want to understand the full script look at
 http://robtone.mine.nu/ipt-set.txt )

Any suggestions or hints would be more than appreciated, thanks. :)


-- 
| Robert Felber (System-Administrator)            Tel: +49 (0) 89 / 453 12-86 |
| Autohaus Erich Kuttendreier                     Fax: +49 (0) 89 / 453 12-80 |
| Drosselweg 21                                   ICQ:              170059451 |
| 81827 Muenchen                                  PGP:               896CF30B |
|                                                                             |
| PGP-Fingerprint: CF36 AA93 9716 63E8 962F 15CC A80E 1A79 BF77 25EA          |

[-- Attachment #2: Type: application/pgp-signature, Size: 187 bytes --]

Re: [LARTC] Policy Routing and NAT

[Patrick McHardy]

Hi Robert,

>$IP route add table 2 via $INET_ROUTER dev eth0
>$IP rule add from 62.225.182.32/29 lookup 2
>

Try one of the latest -rc kernels or apply 66_netfilter-policy-routing.patch
from netfilter patch-o-matic. The netfilter code had some issues wrt. policy
routing and src based table selection.

Patrick

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] Policy Routing and NAT

[Robert Felber]

Am Sa, 2003-08-23 um 11.27 schrieb Patrick McHardy:

> Try one of the latest -rc kernels or apply 66_netfilter-policy-routing.patch

Am trying 2.4.22-rc3 now, but patches are patches - and sometimes they
just won't compile. If the 4th try of a Kernelbuild fails also, I'll
try the netfilter patch. Thanks so far. :)

--
rob

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/

Re: [LARTC] Policy Routing and NAT

[Robert Felber]

[-- Attachment #1: Type: text/plain, Size: 1044 bytes --]

Hi Patrick,

I'm using 2.4.22-rc4 now, but the problem remains.
It's like i need a 3rd round through the routing table - but
after SNAT has been done.

On Sa, 2003-08-23 at 11.27 wrote Patrick McHardy:
> Hi Robert,
> 
> >$IP route add table 2 via $INET_ROUTER dev eth0
> >$IP rule add from 62.225.182.32/29 lookup 2
> >
> 
> Try one of the latest -rc kernels or apply 66_netfilter-policy-routing.patch
> from netfilter patch-o-matic. The netfilter code had some issues wrt. policy
> routing and src based table selection.
> 
> Patrick
-- 
| Robert Felber (System-Administrator)            Tel: +49 (0) 89 / 453 12-86 |
| Autohaus Erich Kuttendreier                     Fax: +49 (0) 89 / 453 12-80 |
| Drosselweg 21                                   ICQ:              170059451 |
| 81827 Muenchen                                  Web: http://robtone.mine.nu |
|                                                 PGP:               896CF30B |
| PGP-Fingerprint: CF36 AA93 9716 63E8 962F 15CC A80E 1A79 BF77 25EA          |

[-- Attachment #2: Dies ist ein digital signierter Nachrichtenteil --]
[-- Type: application/pgp-signature, Size: 187 bytes --]