iptables with alias?

iptables with alias?

[Jeppe Sørensen]

[-- Attachment #1: Type: text/plain, Size: 838 bytes --]

Hello

I have a little question that perhaps someone can help me with

I have a interface to the inet with 4 dynamic ip addr
eth0 = first dynamic ip addr
eth0:0 = second dynmaic ip addr
and so on

I want to make 1 on 1 nat on the frist 2 aliass and the last 2 alias are for the rest of the network
192.168.1.5 nat to eth0
192.168.1.6 nat to eth0:0
192.168.1.7-to-15 nat to eth0:1
192.168.1.16-to-30 nat to eth0:2

but iptables wan't take alias

What do I do / what can I do ?

I have looked in the The netfilter user mailinglist Archives and found the following solution

ip addr add w.x.y.z/bits dev eth0 label eth00

but how does I get it to work with dynamic address?


The archive mail I found the solution in
http://lists.netfilter.org/pipermail/netfilter/2002-June/034592.html


Jeppe Sorensen
Denmark

[-- Attachment #2: Type: text/html, Size: 2617 bytes --]

iptables with alias?

[Jeppe Sørensen]

Hello

I have a little question that perhaps someone can help me with

I have a interface to the inet with 4 dynamic ip addr
eth0 = first dynamic ip addr
eth0:0 = second dynmaic ip addr
and so on

I want to make 1 on 1 nat on the frist 2 aliass and the last 2 alias are for
the rest of the network
192.168.1.5 nat to eth0
192.168.1.6 nat to eth0:0
192.168.1.7-to-15 nat to eth0:1
192.168.1.16-to-30 nat to eth0:2

but iptables wan't take alias

What do I do / what can I do ?

I have looked in the The netfilter user mailinglist Archives and found the
following solution

ip addr add w.x.y.z/bits dev eth0 label eth00

but how does I get it to work with dynamic address?


The archive mail I found the solution in
http://lists.netfilter.org/pipermail/netfilter/2002-June/034592.html


Jeppe Sorensen
Denmark

Re: iptables with alias?

[Antony Stone]

On Saturday 05 October 2002 9:37 pm, Jeppe Sørensen wrote:

> Hello
>
> I have a little question that perhaps someone can help me with
>
> I have a interface to the inet with 4 dynamic ip addr
> eth0 = first dynamic ip addr
> eth0:0 = second dynmaic ip addr
> and so on
>
> I want to make 1 on 1 nat on the frist 2 aliass and the last 2 alias are
> for the rest of the network 192.168.1.5 nat to eth0
> 192.168.1.6 nat to eth0:0
> 192.168.1.7-to-15 nat to eth0:1
> 192.168.1.16-to-30 nat to eth0:2

You're right - netfilter doesn't accept : characters in interface names.

I suggest you create a script to (re)write appropriate SNAT rules, which is 
called by dhcpcd, or whatever else you use to acquire your dynamic 
addresses...

Antony.

-- 

The difference between theory and practice is that
in theory there is no difference, whereas in practice there is.

Re: iptables with alias?

[leolistas]

   I think you'll have to tweak your firewall scripts and build your own 
customized SNAT rules. I mean ..... your firewall script can easily get 
the IP address of the interface ( even alias one ) with something similar 
to:

ifconfig "eth0 " | grep inet | cut -d":" -f 2 | cut -d" " -f 1


   Then, in POSTROUTING you could build your rules, just like:

iptables -t nat -A POSTROUTING -s 192.168.1.5 -j SNAT --to-source $IP_ETH0
iptables -t nat -A POSTROUTING -s 192.168.1.6 -j SNAT --to-source 
$IP_ETH00
iptables -t nat -A POSTROUTING -s 192.168.1.8/29 -j SNAT --to-source 
$IP_ETH01 ( 192.168.1.8/29 matches 7-15 )
... and go on ....

   Note that this script can be only executed after ALL interfaces get 
their IP addresses ....


   Hope this helps,
   Leonardo Rodrigues


Quoting Jeppe Sørensen <smed@tdcadsl.dk>:

> Hello
> 
> I have a little question that perhaps someone can help me with
> 
> I have a interface to the inet with 4 dynamic ip addr
> eth0 = first dynamic ip addr
> eth0:0 = second dynmaic ip addr
> and so on
> 
> I want to make 1 on 1 nat on the frist 2 aliass and the last 2 alias are
> for
> the rest of the network
> 192.168.1.5 nat to eth0
> 192.168.1.6 nat to eth0:0
> 192.168.1.7-to-15 nat to eth0:1
> 192.168.1.16-to-30 nat to eth0:2
> 
> but iptables wan't take alias
> 
> What do I do / what can I do ?
> 
> I have looked in the The netfilter user mailinglist Archives and found
> the
> following solution
> 
> ip addr add w.x.y.z/bits dev eth0 label eth00
> 
> but how does I get it to work with dynamic address?

RE: iptables with alias?

[Stewart Thompson]

Hi Antony:

	This just a test. My posts don't seem to be showing up on the list.

Regards,

Stu........


-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org]On Behalf Of Antony Stone
Sent: October 5, 2002 1:53 PM
To: netfilter@lists.netfilter.org
Subject: Re: iptables with alias?

On Saturday 05 October 2002 9:37 pm, Jeppe Sørensen wrote:

> Hello
>
> I have a little question that perhaps someone can help me with
>
> I have a interface to the inet with 4 dynamic ip addr
> eth0 = first dynamic ip addr
> eth0:0 = second dynmaic ip addr
> and so on
>
> I want to make 1 on 1 nat on the frist 2 aliass and the last 2 alias are
> for the rest of the network 192.168.1.5 nat to eth0
> 192.168.1.6 nat to eth0:0
> 192.168.1.7-to-15 nat to eth0:1
> 192.168.1.16-to-30 nat to eth0:2

You're right - netfilter doesn't accept : characters in interface names.

I suggest you create a script to (re)write appropriate SNAT rules, which is
called by dhcpcd, or whatever else you use to acquire your dynamic
addresses...

Antony.

--

The difference between theory and practice is that
in theory there is no difference, whereas in practice there is.

Trigger firewall Script on IP Change:

[Stewart Thompson]

Hi All:

        Can anyone tell me how to automatically trigger
my firewall script to execute when the IP on the External
Interface changes. Thanks.

Stu.....

Re: Trigger firewall Script on IP Change:

[Antony Stone]

On Saturday 05 October 2002 11:03 pm, Stewart Thompson wrote:

> Hi All:
>
>         Can anyone tell me how to automatically trigger
> my firewall script to execute when the IP on the External
> Interface changes. Thanks.

If your external IP address is changing, you must be using DHCP...

If you're using ISCs dhcpcd, you can create scripts called 
/etc/dhcpc/dhcpcd-<ifname>.exe where <ifname> is eth0, eth1, eth2 etc which 
will get called whenever there's a new address on the interface.

man dhcpcd for a bit more info.

Antony.

-- 

I vote "no" to this proposal to form a committee to investigate whether we 
should or should not hold a ballot on whether to vote yet.

RE: Trigger firewall Script on IP Change:

[Stewart Thompson]

Hi Antony:

	Thanks for the tip. I will have a look.
I new it was possible, I just wasn't sure how.

Regards,

Stu.......


-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org]On Behalf Of Antony Stone
Sent: October 5, 2002 3:39 PM
To: netfilter@lists.netfilter.org
Subject: Re: Trigger firewall Script on IP Change:

On Saturday 05 October 2002 11:03 pm, Stewart Thompson wrote:

> Hi All:
>
>         Can anyone tell me how to automatically trigger
> my firewall script to execute when the IP on the External
> Interface changes. Thanks.

If your external IP address is changing, you must be using DHCP...

If you're using ISCs dhcpcd, you can create scripts called
/etc/dhcpc/dhcpcd-<ifname>.exe where <ifname> is eth0, eth1, eth2 etc which
will get called whenever there's a new address on the interface.

man dhcpcd for a bit more info.

Antony.

--

I vote "no" to this proposal to form a committee to investigate whether we
should or should not hold a ballot on whether to vote yet.