* External Resolved IPs
@ 2003-06-16 21:00 Herbert G. Fischer
2003-06-16 22:33 ` Joel Newkirk
0 siblings, 1 reply; 6+ messages in thread
From: Herbert G. Fischer @ 2003-06-16 21:00 UTC (permalink / raw)
To: NetFilter Users
Hi,
I have a problem here, that maybe I can solve using DNS, but this can be
very bad and ugly
for me to maintain.
I have a internal network that uses a external DNS to solve addresses. I
also have some
servers in this internal network that can be accessed from outside via
aliases on NAT/FW
redirecting some ports to internal servers.
My problem is that, when I try to connect to a internal server, using the
external and real
IP, I cannot because my FW/NAT appears to be confused or misconfigured.
For example:
Internal Network: 172.16.48.0/24
My IP: 172.16.48.10
Server Internal IP: 172.16.48.20
* Both are on the same network
Server External IP: 200.180.180.20 (IP alias on FW/NAT machine, that
redirects to 172.16.48.20)
DNS name of Server: server.domain.com, points to 200.180.180.20
When I try to connect into server.domain.com from internal machines, DNS
resolves the external
IP and the connection to the real IP does not complete, since the packet
goes "out" of my network
and must "enter" again.
Here is a sample on how my iptables script is configured:
====================================================================
# server
iptables -t nat -A POSTROUTING -s 172.16.48.20 -j SNAT --to-source
200.180.180.20
iptables -t nat -A PREROUTING -s 0/0 -d 200.180.180.20 -j
DNAT --to-destination 172.16.48.20
# NAT for the rest of the world
iptables -t nat -A POSTROUTING -o eth1 -s 172.16.48.0/24 -j SNAT --to-source
200.180.180.22
=====================================================================
I don't know how to better explain my problem... I hope someone understood
that...
Any idea on this ?
Thanks...
Herbert
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: External Resolved IPs
2003-06-16 21:00 External Resolved IPs Herbert G. Fischer
@ 2003-06-16 22:33 ` Joel Newkirk
2003-06-17 15:46 ` Herbert G. Fischer
0 siblings, 1 reply; 6+ messages in thread
From: Joel Newkirk @ 2003-06-16 22:33 UTC (permalink / raw)
To: Herbert G. Fischer; +Cc: NetFilter Users
On Mon, 2003-06-16 at 17:00, Herbert G. Fischer wrote:
> My problem is that, when I try to connect to a internal server, using the
> external and real
> IP, I cannot because my FW/NAT appears to be confused or misconfigured.
>
> For example:
>
> Internal Network: 172.16.48.0/24
>
> My IP: 172.16.48.10
> Server Internal IP: 172.16.48.20
> * Both are on the same network
>
> Server External IP: 200.180.180.20 (IP alias on FW/NAT machine, that
> redirects to 172.16.48.20)
> DNS name of Server: server.domain.com, points to 200.180.180.20
> # server
> iptables -t nat -A POSTROUTING -s 172.16.48.20 -j SNAT --to-source
> 200.180.180.20
> iptables -t nat -A PREROUTING -s 0/0 -d 200.180.180.20 -j
> DNAT --to-destination 172.16.48.20
>
> # NAT for the rest of the world
> iptables -t nat -A POSTROUTING -o eth1 -s 172.16.48.0/24 -j SNAT --to-source
> 200.180.180.22
When a request from a local client arrives at the iptables box addressed
to 200.180.180.20, it hits PREROUTING and is DNATted to the appropriate
server. Problem is that the server tries to reply directly to the
client, (since it's a local IP) which sees a 'new' connection from
172.16.48.20, which it ignores. Try adding:
iptables -t nat -A POSTROUTING -d 172.16.48.20 -s 172.16.48.0/24 -j SNAT
--to iptables.box.local.ip
With this additional rule in place, requests from local clients hit the
iptables box and are DNATted to the local server, then before leaving
the iptables box they are SNATted so that the server sends its reply
back to the iptables box. When that reply is received by the iptables
box, it unSNATs and restores the correct destination IP (the local
client) then before it leaves the box it unDNATs to restore the correct
source IP (the local server's public IP).
j
^ permalink raw reply [flat|nested] 6+ messages in thread
* RE: External Resolved IPs
@ 2003-06-17 3:59 Deshwal Chand
0 siblings, 0 replies; 6+ messages in thread
From: Deshwal Chand @ 2003-06-17 3:59 UTC (permalink / raw)
To: 'Herbert G. Fischer', NetFilter Users
[-- Attachment #1: Type: text/plain, Size: 2081 bytes --]
Hi
I also have the same problem and posted it with the subject 'Using IPTABLES,
cannot go to External Interface'. I do have the exact problem. May be if u
get a solution, it will solve mine as well.
Regards,
Chand Deshwal (M.Tech CS&E, MCSE, CCNA)
-----Original Message-----
From: Herbert G. Fischer [mailto:manager@trama.com]
Sent: Tuesday, June 17, 2003 3:31 AM
To: NetFilter Users
Subject: External Resolved IPs
Hi,
I have a problem here, that maybe I can solve using DNS, but this can be
very bad and ugly
for me to maintain.
I have a internal network that uses a external DNS to solve addresses. I
also have some
servers in this internal network that can be accessed from outside via
aliases on NAT/FW
redirecting some ports to internal servers.
My problem is that, when I try to connect to a internal server, using the
external and real
IP, I cannot because my FW/NAT appears to be confused or misconfigured.
For example:
Internal Network: 172.16.48.0/24
My IP: 172.16.48.10
Server Internal IP: 172.16.48.20
* Both are on the same network
Server External IP: 200.180.180.20 (IP alias on FW/NAT machine, that
redirects to 172.16.48.20)
DNS name of Server: server.domain.com, points to 200.180.180.20
When I try to connect into server.domain.com from internal machines, DNS
resolves the external
IP and the connection to the real IP does not complete, since the packet
goes "out" of my network
and must "enter" again.
Here is a sample on how my iptables script is configured:
====================================================================
# server
iptables -t nat -A POSTROUTING -s 172.16.48.20 -j SNAT --to-source
200.180.180.20
iptables -t nat -A PREROUTING -s 0/0 -d 200.180.180.20 -j
DNAT --to-destination 172.16.48.20
# NAT for the rest of the world
iptables -t nat -A POSTROUTING -o eth1 -s 172.16.48.0/24 -j SNAT --to-source
200.180.180.22
=====================================================================
I don't know how to better explain my problem... I hope someone understood
that...
Any idea on this ?
Thanks...
Herbert
[-- Attachment #2: Type: text/html, Size: 3946 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
* RE: External Resolved IPs
@ 2003-06-17 4:40 Deshwal Chand
0 siblings, 0 replies; 6+ messages in thread
From: Deshwal Chand @ 2003-06-17 4:40 UTC (permalink / raw)
To: 'Joel Newkirk', Herbert G. Fischer; +Cc: NetFilter Users
[-- Attachment #1: Type: text/plain, Size: 2242 bytes --]
<<<iptables -t nat -A POSTROUTING -d 172.16.48.20 -s 172.16.48.0/24 -j SNAT
--to iptables.box.local.ip
<<With this additional rule in place, requests from local clients hit the
<<iptables box and are DNATted to the local server, then before leaving
This does not work.
-----Original Message-----
From: Joel Newkirk [mailto:netfilter@newkirk.us]
Sent: Tuesday, June 17, 2003 5:04 AM
To: Herbert G. Fischer
Cc: NetFilter Users
Subject: Re: External Resolved IPs
On Mon, 2003-06-16 at 17:00, Herbert G. Fischer wrote:
> My problem is that, when I try to connect to a internal server, using the
> external and real
> IP, I cannot because my FW/NAT appears to be confused or misconfigured.
>
> For example:
>
> Internal Network: 172.16.48.0/24
>
> My IP: 172.16.48.10
> Server Internal IP: 172.16.48.20
> * Both are on the same network
>
> Server External IP: 200.180.180.20 (IP alias on FW/NAT machine, that
> redirects to 172.16.48.20)
> DNS name of Server: server.domain.com, points to 200.180.180.20
> # server
> iptables -t nat -A POSTROUTING -s 172.16.48.20 -j SNAT --to-source
> 200.180.180.20
> iptables -t nat -A PREROUTING -s 0/0 -d 200.180.180.20 -j
> DNAT --to-destination 172.16.48.20
>
> # NAT for the rest of the world
> iptables -t nat -A POSTROUTING -o eth1 -s 172.16.48.0/24 -j SNAT
--to-source
> 200.180.180.22
When a request from a local client arrives at the iptables box addressed
to 200.180.180.20, it hits PREROUTING and is DNATted to the appropriate
server. Problem is that the server tries to reply directly to the
client, (since it's a local IP) which sees a 'new' connection from
172.16.48.20, which it ignores. Try adding:
iptables -t nat -A POSTROUTING -d 172.16.48.20 -s 172.16.48.0/24 -j SNAT
--to iptables.box.local.ip
With this additional rule in place, requests from local clients hit the
iptables box and are DNATted to the local server, then before leaving
the iptables box they are SNATted so that the server sends its reply
back to the iptables box. When that reply is received by the iptables
box, it unSNATs and restores the correct destination IP (the local
client) then before it leaves the box it unDNATs to restore the correct
source IP (the local server's public IP).
j
[-- Attachment #2: Type: text/html, Size: 4085 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
* RE: External Resolved IPs
@ 2003-06-17 5:33 Deshwal Chand
0 siblings, 0 replies; 6+ messages in thread
From: Deshwal Chand @ 2003-06-17 5:33 UTC (permalink / raw)
To: 'Joel Newkirk', Herbert G. Fischer; +Cc: NetFilter Users
[-- Attachment #1: Type: text/plain, Size: 2517 bytes --]
<<<iptables -t nat -A POSTROUTING -d 172.16.48.20 -s 172.16.48.0/24 -j SNAT
--to iptables.box.local.ip
This rule works for DNATted servers. Now I am able to reach to my servers
from Internal Network. I am still facing a problem. I can not reach to the
External Interface of NAT Box.
For example:
External IP of NAT box is x.y.z.1 at eth0
I am using IP alaiing on eth0 for x.y.z.2, x.y.z.3.
Now from my internal network, I can go to x.y.z.2 and 3, but cannot connect
to a web server at x.y.z.1
Regards,
Chand Deshwal (M.Tech CS&E, MCSE, CCNA)
-----Original Message-----
From: Joel Newkirk [mailto:netfilter@newkirk.us]
Sent: Tuesday, June 17, 2003 5:04 AM
To: Herbert G. Fischer
Cc: NetFilter Users
Subject: Re: External Resolved IPs
On Mon, 2003-06-16 at 17:00, Herbert G. Fischer wrote:
> My problem is that, when I try to connect to a internal server, using the
> external and real
> IP, I cannot because my FW/NAT appears to be confused or misconfigured.
>
> For example:
>
> Internal Network: 172.16.48.0/24
>
> My IP: 172.16.48.10
> Server Internal IP: 172.16.48.20
> * Both are on the same network
>
> Server External IP: 200.180.180.20 (IP alias on FW/NAT machine, that
> redirects to 172.16.48.20)
> DNS name of Server: server.domain.com, points to 200.180.180.20
> # server
> iptables -t nat -A POSTROUTING -s 172.16.48.20 -j SNAT --to-source
> 200.180.180.20
> iptables -t nat -A PREROUTING -s 0/0 -d 200.180.180.20 -j
> DNAT --to-destination 172.16.48.20
>
> # NAT for the rest of the world
> iptables -t nat -A POSTROUTING -o eth1 -s 172.16.48.0/24 -j SNAT
--to-source
> 200.180.180.22
When a request from a local client arrives at the iptables box addressed
to 200.180.180.20, it hits PREROUTING and is DNATted to the appropriate
server. Problem is that the server tries to reply directly to the
client, (since it's a local IP) which sees a 'new' connection from
172.16.48.20, which it ignores. Try adding:
iptables -t nat -A POSTROUTING -d 172.16.48.20 -s 172.16.48.0/24 -j SNAT
--to iptables.box.local.ip
With this additional rule in place, requests from local clients hit the
iptables box and are DNATted to the local server, then before leaving
the iptables box they are SNATted so that the server sends its reply
back to the iptables box. When that reply is received by the iptables
box, it unSNATs and restores the correct destination IP (the local
client) then before it leaves the box it unDNATs to restore the correct
source IP (the local server's public IP).
j
[-- Attachment #2: Type: text/html, Size: 4538 bytes --]
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: External Resolved IPs
2003-06-16 22:33 ` Joel Newkirk
@ 2003-06-17 15:46 ` Herbert G. Fischer
0 siblings, 0 replies; 6+ messages in thread
From: Herbert G. Fischer @ 2003-06-17 15:46 UTC (permalink / raw)
To: Joel Newkirk; +Cc: NetFilter Users
Thanks!!
It worked very well!
Man... You don't have idea on how many problems
you helped me to solve...
----- Original Message -----
From: "Joel Newkirk" <netfilter@newkirk.us>
To: "Herbert G. Fischer" <manager@trama.com>
Cc: "NetFilter Users" <netfilter@lists.netfilter.org>
Sent: Monday, June 16, 2003 7:33 PM
Subject: Re: External Resolved IPs
> On Mon, 2003-06-16 at 17:00, Herbert G. Fischer wrote:
>
> > My problem is that, when I try to connect to a internal server, using
the
> > external and real
> > IP, I cannot because my FW/NAT appears to be confused or misconfigured.
> >
> > For example:
> >
> > Internal Network: 172.16.48.0/24
> >
> > My IP: 172.16.48.10
> > Server Internal IP: 172.16.48.20
> > * Both are on the same network
> >
> > Server External IP: 200.180.180.20 (IP alias on FW/NAT machine, that
> > redirects to 172.16.48.20)
> > DNS name of Server: server.domain.com, points to 200.180.180.20
>
> > # server
> > iptables -t nat -A POSTROUTING -s 172.16.48.20 -j SNAT --to-source
> > 200.180.180.20
> > iptables -t nat -A PREROUTING -s 0/0 -d 200.180.180.20 -j
> > DNAT --to-destination 172.16.48.20
> >
> > # NAT for the rest of the world
> > iptables -t nat -A POSTROUTING -o eth1 -s 172.16.48.0/24 -j
SNAT --to-source
> > 200.180.180.22
>
> When a request from a local client arrives at the iptables box addressed
> to 200.180.180.20, it hits PREROUTING and is DNATted to the appropriate
> server. Problem is that the server tries to reply directly to the
> client, (since it's a local IP) which sees a 'new' connection from
> 172.16.48.20, which it ignores. Try adding:
>
> iptables -t nat -A POSTROUTING -d 172.16.48.20 -s 172.16.48.0/24 -j SNAT
> --to iptables.box.local.ip
>
> With this additional rule in place, requests from local clients hit the
> iptables box and are DNATted to the local server, then before leaving
> the iptables box they are SNATted so that the server sends its reply
> back to the iptables box. When that reply is received by the iptables
> box, it unSNATs and restores the correct destination IP (the local
> client) then before it leaves the box it unDNATs to restore the correct
> source IP (the local server's public IP).
>
> j
>
>
>
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2003-06-17 15:46 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2003-06-16 21:00 External Resolved IPs Herbert G. Fischer
2003-06-16 22:33 ` Joel Newkirk
2003-06-17 15:46 ` Herbert G. Fischer
-- strict thread matches above, loose matches on Subject: below --
2003-06-17 3:59 Deshwal Chand
2003-06-17 4:40 Deshwal Chand
2003-06-17 5:33 Deshwal Chand
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox