RE: Hostname with DNAT ? {OK}

RE: Hostname with DNAT ? {OK}

[Jason Opperisano]

> $IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -d mail.server1.com --dport 25 -j DNAT --to 192.168.14.254:25
> $IPTABLES -A FORWARD -i eth0 -p tcp -d mail1.server.com --dport 25 -j ACCEPT
>
> $IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -d mail.server2.com --dport 25 -j DNAT --to 192.168.14.251:25
> $IPTABLES -A FORWARD -i eth0 -p tcp -d mail.server2.com --dport 25 -j ACCEPT
>
> $IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -d server3.com --dport 25 -j DNAT --to 192.168.14.253:25
> $IPTABLES -A FORWARD -i eth0 -p tcp -d server3.com --dport 25 -j ACCEPT
> $IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -d mail.server3.com --dport 25 -j DNAT --to 192.168.14.253:25
> $IPTABLES -A FORWARD -i eth0 -p tcp -d mail.server3.com --dport 25 -j ACCEPT
>
> Is posibble to use names instead of IP like in my situation ?

using a resolvable hostname instead of an IP in a rule is perfectly valid.  the caveat is:  at the time you execute the script, the hostname is resolved to an IP address and the IP is what ends up in the rule.  if the IP associated with the hostname changes after the rules are loaded--you must reload the rules for the new IP to be used in the rule.

my guess is that the reason you wish to do this is that you have a dynamic IP address and are using some sort of dynamic DNS service.  you will probably want to incorporate the re-loading of your ruleset into your DHCP client whenever your IP changes.  you could actually do this without utilizing the "dynamic DNS + hostname in rules" solution  by incorporating something like this into your ruleset:

	MY_IF="eth0"
	MY_IP=`ip addr sh $MY_IF | grep inet | awk '{print $2}' | cut -d"/" -f1`

	$IPTABLES -A PREROUTING -t nat -i $MY_IF -p tcp -d $MY_IP \
	  --dport 25 -j DNAT --to 192.168.14.251:25

and whenever your IP changes--have the script re-execute to pickup the new IP.

-j

Re: Hostname with DNAT ? {OK}

[Danila Octavian]

I'm afraid i was not very explicit ...

I was trying to use strictly names and that's why :

I have only one public IP and 3 diferrent names. Behind the machine i have a
network with 4 servers which use that names :


Internet ---> eth0(public ip) eth1(private ip) ---> mail.server1.com
                                                                   --->
mail.server2.com
                                                                   --->
mail.server3.com

$IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -d mail.server1.com --dport
25 -j DNAT --to 192.168.14.254:25
$IPTABLES -A FORWARD -i eth0 -p tcp -d mail1.server.com --dport 25 -j ACCEPT

$IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -d mail.server2.com --dport
25 -j DNAT --to 192.168.14.251:25
$IPTABLES -A FORWARD -i eth0 -p tcp -d mail.server2.com --dport 25 -j ACCEPT

$IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -d mail.server3.com --dport
25 -j DNAT --to 192.168.14.253:25
$IPTABLES -A FORWARD -i eth0 -p tcp -d mail.server3.com --dport 25 -j ACCEPT

I realized that iptables uses the resolved IP address but that's exactly
what i was trying to avoid.

Can that be possible ?

Thanks very much in advance,

Danila Octavian



-- 
This message has been scanned for viruses and
dangerous content, and is believed to be clean.
Service.Agress.Ro E-Mail Scanning Service

Re: Hostname with DNAT ? {OK}

[Antony Stone]

On Tuesday 27 July 2004 8:54 am, Danila Octavian wrote:

> I'm afraid i was not very explicit ...
>
> I was trying to use strictly names and that's why :
>
> I have only one public IP and 3 diferrent names. Behind the machine i have
> a network with 4 servers which use that names :

In that case set up one mail relay (which only accepts mail for the four 
domains), feed all external MX records to this one server, and then configure 
it to relay mail for each domain on to each appropriate server.

What you are trying to do is an application layer requirement; netfilter 
cannot do this for you at the network routing layer.

Regards,

Antony.

-- 
I love deadlines.   I love the whooshing noise they make as they go by.

 - Douglas Noel Adams

                                                     Please reply to the list;
                                                           please don't CC me.

Hostname with DNAT ? {OK}

[Danila Octavian]

[-- Attachment #1: Type: text/plain, Size: 1088 bytes --]

hello,

I was wondering if you can guide me how to deal with my situation :
I want to do something like : 

$IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -d mail.server1.com --dport 25 -j DNAT --to 192.168.14.254:25
$IPTABLES -A FORWARD -i eth0 -p tcp -d mail1.server.com --dport 25 -j ACCEPT

$IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -d mail.server2.com --dport 25 -j DNAT --to 192.168.14.251:25
$IPTABLES -A FORWARD -i eth0 -p tcp -d mail.server2.com --dport 25 -j ACCEPT

$IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -d server3.com --dport 25 -j DNAT --to 192.168.14.253:25
$IPTABLES -A FORWARD -i eth0 -p tcp -d server3.com --dport 25 -j ACCEPT
$IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -d mail.server3.com --dport 25 -j DNAT --to 192.168.14.253:25
$IPTABLES -A FORWARD -i eth0 -p tcp -d mail.server3.com --dport 25 -j ACCEPT

Is posibble to use names instead of IP like in my situation ? 

Thanks in advance
-- 
This message has been scanned for viruses and
dangerous content, and is believed to be clean.
Service.Agress.Ro E-Mail Scanning Service


[-- Attachment #2: Type: text/html, Size: 2090 bytes --]

Re: Hostname with DNAT ? {OK}

[Bruno Negrao]

[-- Attachment #1: Type: text/plain, Size: 2240 bytes --]

Hi Danila, there are some error in your rules, first i'll correct them, then i'll tell you about using names
  ----- Original Message ----- 
  From: Danila Octavian 
  To: netfilter@lists.netfilter.org 
  Sent: Monday, July 26, 2004 11:40 AM
  Subject: Hostname with DNAT ? {OK}


  hello,

  I was wondering if you can guide me how to deal with my situation :
  I want to do something like : 

  read carefully this rule:
  $IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -d mail.server1.com --dport 25 -j DNAT --to 192.168.14.254:25
  From now on, when the packet arrives the FORWARD chain of the filter table, it is not destinated to mail.server1.com anymore, since you have just changed its destination IP with the rule above. it is destined to 192.168.14.254.
  the '-d IP' in the rule bellow is wrong:
  $IPTABLES -A FORWARD -i eth0 -p tcp -d mail1.server.com --dport 25 -j ACCEPT
  You should write instead:
  $IPTABLES -A FORWARD -i eth0 -p tcp -d 192.168.14.254 --dport 25 -j ACCEPT

  did you got it?
  This applies for all these rules bellow:

  $IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -d mail.server2.com --dport 25 -j DNAT --to 192.168.14.251:25
  $IPTABLES -A FORWARD -i eth0 -p tcp -d mail.server2.com(wrong) --dport 25 -j ACCEPT
  $IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -d server3.com --dport 25 -j DNAT --to 192.168.14.253:25
  $IPTABLES -A FORWARD -i eth0 -p tcp -d server3.com(wrong) --dport 25 -j ACCEPT
  $IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -d mail.server3.com --dport 25 -j DNAT --to 192.168.14.253:25
  $IPTABLES -A FORWARD -i eth0 -p tcp -d mail.server3.com(wrong) --dport 25 -j ACCEPT

  Is posibble to use names instead of IP like in my situation ? 
  Yes, it is *possible*. It depends of whether your firewall can access the DNS server when it is loading those rules.
  In my firewall, when it is loading the PREROUTING rules, it didn't load the INPUT and OUTPUT rules yet, so it is not permitted to send nor receive any packet, so it can't contact the DNS server to resolve names.

  In my firewall I just load the FORWARD rules after i have loaded the INPUT and OUTPUT chains, so my firewall already can access the DNS server.

  hope it helps,
  bruno

[-- Attachment #2: Type: text/html, Size: 5051 bytes --]

Re: Hostname with DNAT ? {OK}

[Danila Octavian]

[-- Attachment #1: Type: text/plain, Size: 3446 bytes --]


  Hi Danila, there are some error in your rules, first i'll correct them, then i'll tell you about using names

  I know the rules were wrong ... i was in a rush ... u are right, but i was trying to do something else. I will give my setup just to see what i was asking :

  internet ---> public ip eth0 eth1 private ip --> mail.server1.com private ip eth0 eth1 private ip ---> lan
                                                             --> mail.server2.com private ip eth0 eth1 private ip ---> lan
                                                             --> mail.server3.com private ip eth0 eth1 private ip ---> lan  
  The problem is that i have 3 names on the same public IP and i want to send mail traffic to those servers which have private ips.
  I don't want to use smtp on the router with public ip , just redirrect name based to the machines behind accordingly.
  thank you very much for your help,

  Danila Octavian 
    ----- Original Message ----- 
    From: Danila Octavian 
    To: netfilter@lists.netfilter.org 
    Sent: Monday, July 26, 2004 11:40 AM
    Subject: Hostname with DNAT ? {OK}


    hello,

    I was wondering if you can guide me how to deal with my situation :
    I want to do something like : 

    read carefully this rule:
    $IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -d mail.server1.com --dport 25 -j DNAT --to 192.168.14.254:25
    From now on, when the packet arrives the FORWARD chain of the filter table, it is not destinated to mail.server1.com anymore, since you have just changed its destination IP with the rule above. it is destined to 192.168.14.254.
    the '-d IP' in the rule bellow is wrong:
    $IPTABLES -A FORWARD -i eth0 -p tcp -d mail1.server.com --dport 25 -j ACCEPT
    You should write instead:
    $IPTABLES -A FORWARD -i eth0 -p tcp -d 192.168.14.254 --dport 25 -j ACCEPT

    did you got it?
    This applies for all these rules bellow:

    $IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -d mail.server2.com --dport 25 -j DNAT --to 192.168.14.251:25
    $IPTABLES -A FORWARD -i eth0 -p tcp -d mail.server2.com(wrong) --dport 25 -j ACCEPT
    $IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -d server3.com --dport 25 -j DNAT --to 192.168.14.253:25
    $IPTABLES -A FORWARD -i eth0 -p tcp -d server3.com(wrong) --dport 25 -j ACCEPT
    $IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -d mail.server3.com --dport 25 -j DNAT --to 192.168.14.253:25
    $IPTABLES -A FORWARD -i eth0 -p tcp -d mail.server3.com(wrong) --dport 25 -j ACCEPT

    Is posibble to use names instead of IP like in my situation ? 
    Yes, it is *possible*. It depends of whether your firewall can access the DNS server when it is loading those rules.
    In my firewall, when it is loading the PREROUTING rules, it didn't load the INPUT and OUTPUT rules yet, so it is not permitted to send nor receive any packet, so it can't contact the DNS server to resolve names.

    In my firewall I just load the FORWARD rules after i have loaded the INPUT and OUTPUT chains, so my firewall already can access the DNS server.

    hope it helps,
    bruno

  -- 
  This message has been scanned for viruses and 
  dangerous content, and is believed to be clean. 
  Service.Agress.Ro E-Mail Scanning Service. 
-- 
This message has been scanned for viruses and
dangerous content, and is believed to be clean.
Service.Agress.Ro E-Mail Scanning Service


[-- Attachment #2: Type: text/html, Size: 7827 bytes --]