Re: [LARTC] port forwarding to different servers with nat

["trepo " <trepo@azet.sk>]

    If you are in control of the clients accessing the servers, then
Lawrence MacIntyre <lpz@ornl.gov> is right... otherwise not. The
clients --unless configured otherwise-- will always look for the requested
services on the standard ports (i.e. http on port 80), so if you have
multiple servers running the same service, you are out of luck. The router
doing DNAT has no way of telling which server it has to forward to, as all
requests come in with the same destination IP and the same port.

    The case with different services is easier to solve: you set up your
iptables rulesets to forward the service ports to the appropriate machine.

iptables -t nat -A PREROUTING -p tcp --dport {service-port} -j DNAT --to
{server-ip:port}

You may replace 'tcp' with 'udp', depending on the protocol used (see the
iptables manpage).

> But how do the return packets get rewritten?
>
> iptables -t nat -A POSTROUTING -s wilma -j SNAT --to external
> iptables -t nat -A POSTROUTING -s fred -j SNAT --to external
>
> ...seems wrong. Or does it work just fine? (I can't test it right now,
> unfortuantely....)

No, that's right. The return packets are sent to the requester's address,
which has never got rewritten along the way... (not at your box, at least
:) )

Please correct me if I'm wrong.
----------------------------------------------------------------
trepo@azet.sk

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/