Newbie question about nat

Newbie question about nat

[Oriol Magrané]

[-- Attachment #1: Type: text/plain, Size: 3003 bytes --]


    Hello!
    I'm trying to set up a firewall with two ethernets to be installed between the internet and a pool of servers.
    The setup is as follows:

    In the firewall:
        -eth0 with public ip 'a.b.c.d', connected to the internet
        -eth1 with private ip 192.168.1.1, connected to a private class C subnet

    In the internal server 1 (web server):
        -eth0 with private ip 192.168.1.100, connected to the subnet above.

    I have some public ips available (a.b.c.e, a.b.c.f, a.b.c.g,...) so now I want to map the external ip 'a.b.c.e' with the internal ip '192.168.1.100' .

    So in the firewall I do:

        echo 1 > /proc/sys/net/ipv4/ip_forward
        iptables -t nat -A PREROUTING -d a.b.c.e -j DNAT --to 192.168.1.100
        iptables -t nat -A POSTROUTING -s 192.168.1.100 -j SNAT --to a.b.c.e

    This should effectively

        -change destination from a.b.c.e to 192.168.1.100 for packets entering the firewall
        -and change source from 192.168.1.100 to a.b.c.e for packets leaving the firewall

    Now, if I ping the public address of the internal server 1 (a.b.c.e) from the internet, each packet should traverse the firewall like this:

        1. @internet: source=w.x.y.z, destination=a.b.c.e
        2. @firewall-prerouting: source=w.x.y.z, destination=192.168.1.100 (destination changed by nat rule 1)
        3. @firewall-postrouting: source=w.x.y.z, destination=192.168.1.100 (no changes)
        4. @internal_server_1: source=w.x.y.z, destination=192.168.1.100 (so the packet reaches the target)

    and then, when the internal server bounces the ping:

        1. @internal_server_1: source=192.168.1.100, destination=w.x.y.z
        2. @firewall-prerouting: source=192.168.1.100, destination=w.x.y.z (no changes)
        3. @firewall-postrouting: source=a.b.c.e, destination=w.x.y.z (source changed by nat rule 2)
        4. @internet: source=a.b.c.e, destination=w.x.y.z (so the packet reaches the target)


    But this won't work, because the firewall doesn't know it must process packets with destination ips other than its own ip (a.b.c.e, a.b.c.f, etc...), and my ISP doesn't know which machine must deliver these packets to.
    So the question is: how can I make the firewall to process the packets with destinations a.b.c.e, a.b.c.f, etc.? 
    The only solution I've found is to define an ip alias in the firewall itself so that eth0:1 will respond to the external ip a.b.c.e
    Thus when the router of my ISP asks "who has ip a.b.c.e?", the firewall will answer "me" and it will process the packet and deliver it to the internal server 1.

    But this solution means defining an alias for every external ip I want to firewall. So if I have eight servers firewalled I will need eight ip alias in the firewall.

    Is this the right way to do it? Or there is a cleaner/easier/better method to achieve the same?

    Thank you very much in advance,

    Oriol
    Barcelona


[-- Attachment #2: Type: text/html, Size: 6726 bytes --]

Re: Newbie question about nat

[Antony Stone]

On Friday 30 April 2004 7:20 pm, Oriol Magrané wrote:

>     Hello!
>     I'm trying to set up a firewall with two ethernets to be installed
> between the internet and a pool of servers.
>
>     I have some public ips available (a.b.c.e, a.b.c.f, a.b.c.g,...) so now
> I want to map the external ip 'a.b.c.e' with the internal ip 192.168.1.100
>
> The only solution I've found is to define an ip alias in the firewall itself
> so that eth0:1 will respond to the external ip a.b.c.e Thus when the router
> of my ISP asks "who has ip a.b.c.e?", the firewall will answer "me" and it
> will process the packet and deliver it to the internal server 1.
>
>     But this solution means defining an alias for every external ip I want
> to firewall. So if I have eight servers firewalled I will need eight ip
> alias in the firewall.

Correct.   This is not a problem.

However, it is recommended that you use the new (well, not that new, but more 
recent) "ip" commands to add addresses to interfaces, rather than the 
deprecated ethn:x alias method.

Try: "ip addr add a.b.c.e dev eth0" instead of the ifconfig eth0:1 command.

Regards,

Antony.

-- 
"It would appear we have reached the limits of what it is possible to achieve 
with computer technology, although one should be careful with such 
statements; they tend to sound pretty silly in five years."

 - John von Neumann (1949)

                                                     Please reply to the list;
                                                           please don't CC me.

Re: Newbie question about nat

[Alexis]

[-- Attachment #1: Type: text/plain, Size: 3518 bytes --]

http://www.netfilter.org/documentation/HOWTO//NAT-HOWTO-9.html

just think about it, you need the l2 match too :)

if you dont teach arp that you have those IP, so the router can know that a.b.c.g is in aa.bb.cc.dd.ee it wont know where to send the packet.



  ----- Original Message ----- 
  From: Oriol Magrané 
  To: netfilter@lists.netfilter.org 
  Sent: Friday, April 30, 2004 3:20 PM
  Subject: Newbie question about nat



      Hello!
      I'm trying to set up a firewall with two ethernets to be installed between the internet and a pool of servers.
      The setup is as follows:

      In the firewall:
          -eth0 with public ip 'a.b.c.d', connected to the internet
          -eth1 with private ip 192.168.1.1, connected to a private class C subnet

      In the internal server 1 (web server):
          -eth0 with private ip 192.168.1.100, connected to the subnet above.

      I have some public ips available (a.b.c.e, a.b.c.f, a.b.c.g,...) so now I want to map the external ip 'a.b.c.e' with the internal ip '192.168.1.100' .

      So in the firewall I do:

          echo 1 > /proc/sys/net/ipv4/ip_forward
          iptables -t nat -A PREROUTING -d a.b.c.e -j DNAT --to 192.168.1.100
          iptables -t nat -A POSTROUTING -s 192.168.1.100 -j SNAT --to a.b.c.e

      This should effectively

          -change destination from a.b.c.e to 192.168.1.100 for packets entering the firewall
          -and change source from 192.168.1.100 to a.b.c.e for packets leaving the firewall

      Now, if I ping the public address of the internal server 1 (a.b.c.e) from the internet, each packet should traverse the firewall like this:

          1. @internet: source=w.x.y.z, destination=a.b.c.e
          2. @firewall-prerouting: source=w.x.y.z, destination=192.168.1.100 (destination changed by nat rule 1)
          3. @firewall-postrouting: source=w.x.y.z, destination=192.168.1.100 (no changes)
          4. @internal_server_1: source=w.x.y.z, destination=192.168.1.100 (so the packet reaches the target)

      and then, when the internal server bounces the ping:

          1. @internal_server_1: source=192.168.1.100, destination=w.x.y.z
          2. @firewall-prerouting: source=192.168.1.100, destination=w.x.y.z (no changes)
          3. @firewall-postrouting: source=a.b.c.e, destination=w.x.y.z (source changed by nat rule 2)
          4. @internet: source=a.b.c.e, destination=w.x.y.z (so the packet reaches the target)


      But this won't work, because the firewall doesn't know it must process packets with destination ips other than its own ip (a.b.c.e, a.b.c.f, etc...), and my ISP doesn't know which machine must deliver these packets to.
      So the question is: how can I make the firewall to process the packets with destinations a.b.c.e, a.b.c.f, etc.? 
      The only solution I've found is to define an ip alias in the firewall itself so that eth0:1 will respond to the external ip a.b.c.e
      Thus when the router of my ISP asks "who has ip a.b.c.e?", the firewall will answer "me" and it will process the packet and deliver it to the internal server 1.

      But this solution means defining an alias for every external ip I want to firewall. So if I have eight servers firewalled I will need eight ip alias in the firewall.

      Is this the right way to do it? Or there is a cleaner/easier/better method to achieve the same?

      Thank you very much in advance,

      Oriol
      Barcelona


[-- Attachment #2: Type: text/html, Size: 8404 bytes --]

Re: Newbie question about nat

[Oriol Magrané]

    Thank you!
    Now I'd like to set up an ftp server inside with private ip
192.168.1.111 and public ip a.b.c.k
    So the nat rules will be:

        iptables -t nat -A PREROUTING -d a.b.c.k -j DNAT --to 192.168.1.111
        iptables -t nat -A POSTROUTING -s 192.168.1.111 -j SNAT --to a.b.c.k

    However I don't know how to use the ip_conntrack_ftp and ip_nat_ftp
modules when it comes to write the accept/drop rules.
    If the server was a web server, I would use these rules:

        iptables -A FORWARD -d 192.168.1.111 -p tcp --destination-port 80 -m
state --state NEW,ESTABLISHED -j ACCEPT
        iptables -A FORWARD -s 192.168.1.111 -p tcp --source-port 80 -m
state --state ESTABLISHED -j ACCEPT

    But how should they be to allow active ftp access to 192.168.1.111 using
the ip_conntrack_ftp and ip_nat_ftp modules?

    Thank you very much in advance!!

    Oriol



----- Original Message ----- 
From: "Antony Stone" <Antony@Soft-Solutions.co.uk>
To: <netfilter@lists.netfilter.org>
Cc: <netfilter@lists.netfilter.org>
Sent: Friday, April 30, 2004 8:37 PM
Subject: Re: Newbie question about nat


On Friday 30 April 2004 7:20 pm, Oriol Magrané wrote:

>     Hello!
>     I'm trying to set up a firewall with two ethernets to be installed
> between the internet and a pool of servers.
>
>     I have some public ips available (a.b.c.e, a.b.c.f, a.b.c.g,...) so
now
> I want to map the external ip 'a.b.c.e' with the internal ip 192.168.1.100
>
> The only solution I've found is to define an ip alias in the firewall
itself
> so that eth0:1 will respond to the external ip a.b.c.e Thus when the
router
> of my ISP asks "who has ip a.b.c.e?", the firewall will answer "me" and it
> will process the packet and deliver it to the internal server 1.
>
>     But this solution means defining an alias for every external ip I want
> to firewall. So if I have eight servers firewalled I will need eight ip
> alias in the firewall.

Correct.   This is not a problem.

However, it is recommended that you use the new (well, not that new, but
more
recent) "ip" commands to add addresses to interfaces, rather than the
deprecated ethn:x alias method.

Try: "ip addr add a.b.c.e dev eth0" instead of the ifconfig eth0:1 command.

Regards,

Antony.

-- 
"It would appear we have reached the limits of what it is possible to
achieve
with computer technology, although one should be careful with such
statements; they tend to sound pretty silly in five years."

 - John von Neumann (1949)

                                                     Please reply to the
list;
                                                           please don't CC
me.

Re: Newbie question about nat

[Antony Stone]

On Monday 03 May 2004 4:33 pm, Oriol Magrané wrote:

>     Thank you!
>     Now I'd like to set up an ftp server inside with private ip
> 192.168.1.111 and public ip a.b.c.k
>     So the nat rules will be:
>
>         iptables -t nat -A PREROUTING -d a.b.c.k -j DNAT --to 192.168.1.111
>         iptables -t nat -A POSTROUTING -s 192.168.1.111 -j SNAT --to
> a.b.c.k
>
>     However I don't know how to use the ip_conntrack_ftp and ip_nat_ftp
> modules when it comes to write the accept/drop rules.
>     If the server was a web server, I would use these rules:
>
>         iptables -A FORWARD -d 192.168.1.111 -p tcp --destination-port 80
> -m state --state NEW,ESTABLISHED -j ACCEPT
>         iptables -A FORWARD -s 192.168.1.111 -p tcp --source-port 80 -m
> state --state ESTABLISHED -j ACCEPT

I don't normally write an ESTABLISHED rule for each protocol (specifying the 
source port) - I would normally have just one rule on a firewall allowing 
reply packets for all protocols:

iptables -I FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

You don't need to bother about securing the machines it's supposed to allow 
connections from (-s) or the protocols it's supposed to allow (-p tcp, 
--sport) because those have already been taken care of by the rule allowing 
the connection to get set up in the first place.   Note the -I (insert) to 
make sure this rule appears at the top of the FORWARD chain for efficiency.

>     But how should they be to allow active ftp access to 192.168.1.111
> using the ip_conntrack_ftp and ip_nat_ftp modules?

iptables -A FORWARD -d 192.168.1.111 -p tcp --dport 21 -j ACCEPT

along with the single system-wide rule I gave above.

Regards,

Antony.

-- 
"There has always been an underlying argument that we should open up our 
source code more broadly. The fact is that we are learning from open source 
and we are opening our code more broadly through Shared Source.

Is there value to providing source code? The answer is unequivocally yes."

 - Jason Matusow, head of Microsoft's Shared Source Program, in response to 
recent leaks of Windows source code on the Internet.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: Newbie question about nat

[Oriol Magrané]

    Thank you very much!! It works perfectly!! :-)

    And now one last question: from a security point of view, what do you
think is better; discarding packets with DROP or with REJECT?
    Regards,

    Oriol


----- Original Message ----- 
From: "Antony Stone" <Antony@Soft-Solutions.co.uk>
To: <netfilter@lists.netfilter.org>
Sent: Monday, May 03, 2004 5:54 PM
Subject: Re: Newbie question about nat


On Monday 03 May 2004 4:33 pm, Oriol Magrané wrote:

>     Thank you!
>     Now I'd like to set up an ftp server inside with private ip
> 192.168.1.111 and public ip a.b.c.k
>     So the nat rules will be:
>
>         iptables -t nat -A PREROUTING -d a.b.c.k -j DNAT --to
192.168.1.111
>         iptables -t nat -A POSTROUTING -s 192.168.1.111 -j SNAT --to
> a.b.c.k
>
>     However I don't know how to use the ip_conntrack_ftp and ip_nat_ftp
> modules when it comes to write the accept/drop rules.
>     If the server was a web server, I would use these rules:
>
>         iptables -A FORWARD -d 192.168.1.111 -p tcp --destination-port 80
> -m state --state NEW,ESTABLISHED -j ACCEPT
>         iptables -A FORWARD -s 192.168.1.111 -p tcp --source-port 80 -m
> state --state ESTABLISHED -j ACCEPT

I don't normally write an ESTABLISHED rule for each protocol (specifying the
source port) - I would normally have just one rule on a firewall allowing
reply packets for all protocols:

iptables -I FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

You don't need to bother about securing the machines it's supposed to allow
connections from (-s) or the protocols it's supposed to allow (-p tcp,
--sport) because those have already been taken care of by the rule allowing
the connection to get set up in the first place.   Note the -I (insert) to
make sure this rule appears at the top of the FORWARD chain for efficiency.

>     But how should they be to allow active ftp access to 192.168.1.111
> using the ip_conntrack_ftp and ip_nat_ftp modules?

iptables -A FORWARD -d 192.168.1.111 -p tcp --dport 21 -j ACCEPT

along with the single system-wide rule I gave above.

Regards,

Antony.

-- 
"There has always been an underlying argument that we should open up our
source code more broadly. The fact is that we are learning from open source
and we are opening our code more broadly through Shared Source.

Is there value to providing source code? The answer is unequivocally yes."

 - Jason Matusow, head of Microsoft's Shared Source Program, in response to
recent leaks of Windows source code on the Internet.

                                                     Please reply to the
list;
                                                           please don't CC
me.

Re: Newbie question about nat

[Antony Stone]

On Tuesday 04 May 2004 4:55 pm, Oriol Magrané wrote:

>     Thank you very much!! It works perfectly!! :-)
>
>     And now one last question: from a security point of view, what do you
> think is better; discarding packets with DROP or with REJECT?

I tend to DROP to the outside world (don't let them know there's an 
intelligent system dropping their packets - just let them think they fell off 
the end of a cable somewhere), and REJECT to my internal users (so they get a 
quick response saying "that website cannot be found" or "remote host closed 
connection" or whatever, and they don't spend ages waiting for a timeout when 
they could be getting on with something more useful).

Regards,

Antony.

-- 
It is also possible that putting the birds in a laboratory setting 
inadvertently renders them relatively incompetent.

 - Daniel C Dennet

                                                     Please reply to the list;
                                                           please don't CC me.