How to invert more than one destination network?

How to invert more than one destination network?

[Gonzalo Parra]

[-- Attachment #1.1: Type: text/plain, Size: 589 bytes --]

Hi
 
I have MASQUERADE in a box as a gateway using IPTABLES and I am using that
box also for VPN... so for it to work I cant masquerade thaffic that goes to
the other side of the VPN...
 
This works for me:
 
IPTABLES -t nat -A POSTROUTING -o $EXTIF -d \! 192.168.20.0/26 -j MASQUERADE
 
but now I have another network at the other side of the VPN
(192.168.40.0/26), so how can I invert two networks in the -d???
 
Thanks,
 
Gonzalo Parra  
Network Administrator
Tel: +58 (212) 265-5330
Cel: +58 (414) 240-4054
Caracas, VE
.....................................  

 

[-- Attachment #1.2: Type: text/html, Size: 2805 bytes --]

[-- Attachment #2: signature.bmp --]
[-- Type: image/bmp, Size: 7878 bytes --]

Re: How to invert more than one destination network?

[Alexis]

add a new line with the second network :)


On Mon, 2004-03-01 at 12:58, Gonzalo Parra wrote:
> Hi
>  
> I have MASQUERADE in a box as a gateway using IPTABLES and I am using
> that box also for VPN... so for it to work I cant masquerade thaffic
> that goes to the other side of the VPN...
>  
> This works for me:
>  
> IPTABLES -t nat -A POSTROUTING -o $EXTIF -d \! 192.168.20.0/26 -j
> MASQUERADE
>  
> but now I have another network at the other side of the VPN
> (192.168.40.0/26), so how can I invert two networks in the -d???
>  
> Thanks,
>  
> Gonzalo Parra  
> Network Administrator
> Tel: +58 (212) 265-5330
> Cel: +58 (414) 240-4054
> Caracas, VE
> .....................................  
> 
>  
-- 
Tus problemas no se pueden resolver en el mismo
nivel mental que tenías cuando los creaste. 
		Albert Einstein

RE: How to invert more than one destination network?

[Gonzalo Parra]

Is it that simple?

I had the thought that that would make IPTABLES to masquerade everithing...

I mean: first rule will say MASQUERADE everything but 192.168.20.0/26 and
the seccond one will say MASQUERADE everything but 192.168.40.0/26 so every
IP (even those inside those networks) will always find a rule to go
MAQUERADED...

-----Original Message-----
From: Alexis [mailto:alexis@attla.net.ar] 
Sent: Lunes, 01 de Marzo de 2004 12:08 p.m.
To: gparra@cyclelogic.com
Cc: Netfilter
Subject: Re: How to invert more than one destination network?


add a new line with the second network :)


On Mon, 2004-03-01 at 12:58, Gonzalo Parra wrote:
> Hi
>  
> I have MASQUERADE in a box as a gateway using IPTABLES and I am using 
> that box also for VPN... so for it to work I cant masquerade thaffic 
> that goes to the other side of the VPN...
>  
> This works for me:
>  
> IPTABLES -t nat -A POSTROUTING -o $EXTIF -d \! 192.168.20.0/26 -j 
> MASQUERADE
>  
> but now I have another network at the other side of the VPN 
> (192.168.40.0/26), so how can I invert two networks in the -d???
>  
> Thanks,
>  
> Gonzalo Parra
> Network Administrator
> Tel: +58 (212) 265-5330
> Cel: +58 (414) 240-4054
> Caracas, VE
> .....................................  
> 
>  
-- 
Tus problemas no se pueden resolver en el mismo
nivel mental que tenías cuando los creaste. 
		Albert Einstein

Re: How to invert more than one destination network?

[Antony Stone]

On Monday 01 March 2004 3:58 pm, Gonzalo Parra wrote:

> Hi
>
> I have MASQUERADE in a box as a gateway using IPTABLES and I am using that
> box also for VPN... so for it to work I cant masquerade thaffic that goes
> to the other side of the VPN...
>
> This works for me:
>
> IPTABLES -t nat -A POSTROUTING -o $EXTIF -d \! 192.168.20.0/26 -j
> MASQUERADE
>
> but now I have another network at the other side of the VPN
> (192.168.40.0/26), so how can I invert two networks in the -d???

Depending on how your VPN is set up, are you sure that packets to the other 
end of it are going out through $EXTIF anyway?   I run VPNs using FreeS/WAN, 
and all the VPN traffic goes out through interface ipsec0, which I do not 
masquerade.

Anyway, assuming that you do need to do what you asked, try matching the 
packets you don't want to masquerade, first, then masquerading anything 
that's left:

iptables -A POSTROUTING -t nat -o $EXTIF -d 192.168.20.0/26 -j ACCEPT
iptables -A POSTROUTING -t nat -o $EXTIF -d 192.168.40.0/26 -j ACCEPT
iptables -A POSTROUTING -t nat -o $EXTIF -j MASQUERADE

Regards,

Antony.

-- 
You can spend the whole of your life trying to be popular,
but at the end of the day the size of the crowd at your funeral
will be largely dictated by the weather.

 - Frank Skinner

                                                     Please reply to the list;
                                                           please don't CC me.

Re: How to invert more than one destination network?

[Antony Stone]

On Monday 01 March 2004 4:17 pm, Gonzalo Parra wrote:

> Is it that simple?
>
> I had the thought that that would make IPTABLES to masquerade everithing...

You are correct.   See my previous posting for a suggestion on how to do it.

Antony.

> I mean: first rule will say MASQUERADE everything but 192.168.20.0/26 and
> the seccond one will say MASQUERADE everything but 192.168.40.0/26 so every
> IP (even those inside those networks) will always find a rule to go
> MAQUERADED...
>
> -----Original Message-----
> From: Alexis [mailto:alexis@attla.net.ar]
> Sent: Lunes, 01 de Marzo de 2004 12:08 p.m.
> To: gparra@cyclelogic.com
> Cc: Netfilter
> Subject: Re: How to invert more than one destination network?
>
>
> add a new line with the second network :)
>
> On Mon, 2004-03-01 at 12:58, Gonzalo Parra wrote:
> > Hi
> >
> > I have MASQUERADE in a box as a gateway using IPTABLES and I am using
> > that box also for VPN... so for it to work I cant masquerade thaffic
> > that goes to the other side of the VPN...
> >
> > This works for me:
> >
> > IPTABLES -t nat -A POSTROUTING -o $EXTIF -d \! 192.168.20.0/26 -j
> > MASQUERADE
> >
> > but now I have another network at the other side of the VPN
> > (192.168.40.0/26), so how can I invert two networks in the -d???
> >
> > Thanks,
> >
> > Gonzalo Parra
> > Network Administrator
> > Tel: +58 (212) 265-5330
> > Cel: +58 (414) 240-4054
> > Caracas, VE
> > .....................................

-- 
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
A: Top-posting.
Q: What is the most annoying thing on usenet and in e-mail?

                                                     Please reply to the list;
                                                           please don't CC me.