From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Alexis" Subject: Re: Newbie question about nat Date: Sat, 1 May 2004 09:59:20 -0300 Sender: netfilter-admin@lists.netfilter.org Message-ID: <004101c42f7c$1e9ef2c0$0200000a@heretic> References: <004901c42edf$c73c77b0$a704a8c0@mpro4167> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_003E_01C42F62.F8D2EDD0" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter This is a multi-part message in MIME format. ------=_NextPart_000_003E_01C42F62.F8D2EDD0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable http://www.netfilter.org/documentation/HOWTO//NAT-HOWTO-9.html just think about it, you need the l2 match too :) if you dont teach arp that you have those IP, so the router can know = that a.b.c.g is in aa.bb.cc.dd.ee it wont know where to send the packet. ----- Original Message -----=20 From: Oriol Magran=E9=20 To: netfilter@lists.netfilter.org=20 Sent: Friday, April 30, 2004 3:20 PM Subject: Newbie question about nat Hello! I'm trying to set up a firewall with two ethernets to be installed = between the internet and a pool of servers. The setup is as follows: In the firewall: -eth0 with public ip 'a.b.c.d', connected to the internet -eth1 with private ip 192.168.1.1, connected to a private = class C subnet In the internal server 1 (web server): -eth0 with private ip 192.168.1.100, connected to the subnet = above. I have some public ips available (a.b.c.e, a.b.c.f, a.b.c.g,...) = so now I want to map the external ip 'a.b.c.e' with the internal ip = '192.168.1.100' . So in the firewall I do: echo 1 > /proc/sys/net/ipv4/ip_forward iptables -t nat -A PREROUTING -d a.b.c.e -j DNAT --to = 192.168.1.100 iptables -t nat -A POSTROUTING -s 192.168.1.100 -j SNAT --to = a.b.c.e This should effectively -change destination from a.b.c.e to 192.168.1.100 for packets = entering the firewall -and change source from 192.168.1.100 to a.b.c.e for packets = leaving the firewall Now, if I ping the public address of the internal server 1 = (a.b.c.e) from the internet, each packet should traverse the firewall = like this: 1. @internet: source=3Dw.x.y.z, destination=3Da.b.c.e 2. @firewall-prerouting: source=3Dw.x.y.z, = destination=3D192.168.1.100 (destination changed by nat rule 1) 3. @firewall-postrouting: source=3Dw.x.y.z, = destination=3D192.168.1.100 (no changes) 4. @internal_server_1: source=3Dw.x.y.z, = destination=3D192.168.1.100 (so the packet reaches the target) and then, when the internal server bounces the ping: 1. @internal_server_1: source=3D192.168.1.100, = destination=3Dw.x.y.z 2. @firewall-prerouting: source=3D192.168.1.100, = destination=3Dw.x.y.z (no changes) 3. @firewall-postrouting: source=3Da.b.c.e, = destination=3Dw.x.y.z (source changed by nat rule 2) 4. @internet: source=3Da.b.c.e, destination=3Dw.x.y.z (so the = packet reaches the target) But this won't work, because the firewall doesn't know it must = process packets with destination ips other than its own ip (a.b.c.e, = a.b.c.f, etc...), and my ISP doesn't know which machine must deliver = these packets to. So the question is: how can I make the firewall to process the = packets with destinations a.b.c.e, a.b.c.f, etc.?=20 The only solution I've found is to define an ip alias in the = firewall itself so that eth0:1 will respond to the external ip a.b.c.e Thus when the router of my ISP asks "who has ip a.b.c.e?", the = firewall will answer "me" and it will process the packet and deliver it = to the internal server 1. But this solution means defining an alias for every external ip I = want to firewall. So if I have eight servers firewalled I will need = eight ip alias in the firewall. Is this the right way to do it? Or there is a = cleaner/easier/better method to achieve the same? Thank you very much in advance, Oriol Barcelona ------=_NextPart_000_003E_01C42F62.F8D2EDD0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
h= ttp://www.netfilter.org/documentation/HOWTO//NAT-HOWTO-9.html<= /DIV>
 
just think about it, you need the l2 = match too=20 :)
 
if you dont teach arp that you have = those IP, so=20 the router can know that a.b.c.g is in aa.bb.cc.dd.ee it wont know where = to send=20 the packet.
 
 
 
----- Original Message -----
From:=20 Oriol=20 Magran=E9
To: netfilter@lists.netfilter.o= rg=20
Sent: Friday, April 30, 2004 = 3:20=20 PM
Subject: Newbie question about = nat

 
    = Hello!
    I'm trying to set = up a=20 firewall with two ethernets to be installed between the internet and a = pool of=20 servers.
    The setup is as=20 follows:
 
    In the = firewall:
        = -eth0 with=20 public ip 'a.b.c.d', connected to the internet
        = -eth1 with=20 private ip 192.168.1.1, connected to a private class C = subnet
 
    In the = internal server 1=20 (web server):
        = -eth0 with=20 private ip 192.168.1.100, connected to the subnet above.
 
    I have some public = ips=20 available (a.b.c.e, a.b.c.f, a.b.c.g,...) so now I want to map the = external ip=20 'a.b.c.e' with the internal ip '192.168.1.100' .
 
    So in the firewall = I=20 do:
 
        = echo 1 >=20 /proc/sys/net/ipv4/ip_forward
        iptables -t nat -A = PREROUTING -d a.b.c.e -j DNAT = --to 192.168.1.100
       =20 iptables -t nat -A POSTROUTING -s 192.168.1.100 -j SNAT --to=20 a.b.c.e
 
    This should=20 effectively
 
        = -change=20 destination from a.b.c.e to 192.168.1.100 for packets entering the=20 firewall
        = -and change=20 source from 192.168.1.100 to a.b.c.e for packets leaving the=20 firewall
 
    Now, if I ping the = public=20 address of the internal server 1 (a.b.c.e) from the internet, each = packet=20 should traverse the firewall like this:
 
       =20 1. @internet: source=3Dw.x.y.z, = destination=3Da.b.c.e
        = 2.=20 @firewall-prerouting: source=3Dw.x.y.z, destination=3D192.168.1.100 = (destination=20 changed by nat rule 1)
        = 3.=20 @firewall-postrouting: source=3Dw.x.y.z, destination=3D192.168.1.100 = (no=20 changes)
        = 4.=20 @internal_server_1: source=3Dw.x.y.z, destination=3D192.168.1.100 (so = the packet=20 reaches the target)
 
    and then, when the = internal=20 server bounces the ping:
 
        1.=20 @internal_server_1: source=3D192.168.1.100, = destination=3Dw.x.y.z
        2.=20 @firewall-prerouting: source=3D192.168.1.100, destination=3Dw.x.y.z = (no=20 changes)
        3.=20 @firewall-postrouting: source=3Da.b.c.e, destination=3Dw.x.y.z (source = changed by=20 nat rule 2)
        4.=20 @internet: source=3Da.b.c.e, destination=3Dw.x.y.z (so the packet = reaches the=20 target)
 
 
    But this won't = work, because=20 the firewall doesn't know it must = process=20 packets with destination ips other than its own ip (a.b.c.e, = a.b.c.f,=20 etc...), and my ISP doesn't know which machine must deliver these = packets=20 to.
    So the question is: how can I make the firewall to process the = packets with=20 destinations a.b.c.e, a.b.c.f, etc.?
    The only solution = I've found=20 is to define an ip alias in the firewall itself so that eth0:1 = will=20 respond to the external ip a.b.c.e
    Thus when the = router of my ISP=20 asks "who has ip a.b.c.e?", the firewall will answer "me" and it will = process=20 the packet and deliver it to the internal server 1.
 
    But this solution = means=20 defining an alias for every external ip I want to firewall. So if I = have eight=20 servers firewalled I will need eight ip alias in the = firewall.
 
    Is this the right = way to do=20 it? Or there is a cleaner/easier/better method to achieve the=20 same?
 
    Thank you very = much in=20 advance,
 
    Oriol
    = Barcelona
 
 
------=_NextPart_000_003E_01C42F62.F8D2EDD0--