Re: External Resolved IPs

["Herbert G. Fischer" <manager@trama.com>]

Thanks!!

It worked very well!

Man... You don't have idea on how many problems
you helped me to solve...

----- Original Message ----- 
From: "Joel Newkirk" <netfilter@newkirk.us>
To: "Herbert G. Fischer" <manager@trama.com>
Cc: "NetFilter Users" <netfilter@lists.netfilter.org>
Sent: Monday, June 16, 2003 7:33 PM
Subject: Re: External Resolved IPs


> On Mon, 2003-06-16 at 17:00, Herbert G. Fischer wrote:
>
> > My problem is that, when I try to connect to a internal server, using
the
> > external and real
> > IP, I cannot because my FW/NAT appears to be confused or misconfigured.
> >
> > For example:
> >
> > Internal Network: 172.16.48.0/24
> >
> > My IP: 172.16.48.10
> > Server Internal IP: 172.16.48.20
> > * Both are on the same network
> >
> > Server External IP: 200.180.180.20 (IP alias on FW/NAT machine, that
> > redirects to 172.16.48.20)
> > DNS name of Server: server.domain.com, points to 200.180.180.20
>
> > # server
> > iptables -t nat -A POSTROUTING -s 172.16.48.20 -j SNAT --to-source
> > 200.180.180.20
> > iptables -t nat -A PREROUTING -s 0/0 -d 200.180.180.20 -j
> > DNAT --to-destination 172.16.48.20
> >
> > # NAT for the rest of the world
> > iptables -t nat -A POSTROUTING -o eth1 -s 172.16.48.0/24 -j
SNAT --to-source
> > 200.180.180.22
>
> When a request from a local client arrives at the iptables box addressed
> to 200.180.180.20, it hits PREROUTING and is DNATted to the appropriate
> server.  Problem is that the server tries to reply directly to the
> client, (since it's a local IP) which sees a 'new' connection from
> 172.16.48.20, which it ignores.  Try adding:
>
> iptables -t nat -A POSTROUTING -d 172.16.48.20 -s 172.16.48.0/24 -j SNAT
> --to iptables.box.local.ip
>
> With this additional rule in place, requests from local clients hit the
> iptables box and are DNATted to the local server, then before leaving
> the iptables box they are SNATted so that the server sends its reply
> back to the iptables box.  When that reply is received by the iptables
> box, it unSNATs and restores the correct destination IP (the local
> client) then before it leaves the box it unDNATs to restore the correct
> source IP (the local server's public IP).
>
> j
>
>
>