From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Danila Octavian" Subject: Re: Hostname with DNAT ? {OK} Date: Wed, 28 Jul 2004 09:18:14 +0300 Sender: netfilter-admin@lists.netfilter.org Message-ID: <016b01c4746a$be09df90$da0da8c0@pisic> References: <001701c4731e$8408f850$da0da8c0@pisic> <011401c473e4$5db3d1e0$5100a8c0@egp> Reply-To: "Danila Octavian" Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0168_01C47483.CF5CA6B0" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: Bruno Negrao Cc: netfilter@lists.netfilter.org This is a multi-part message in MIME format. ------=_NextPart_000_0168_01C47483.CF5CA6B0 Content-Type: text/plain; charset="iso-8859-2" Content-Transfer-Encoding: quoted-printable Hi Danila, there are some error in your rules, first i'll correct them, t= hen i'll tell you about using names I know the rules were wrong ... i was in a rush ... u are right, but i wa= s trying to do something else. I will give my setup just to see what i was = asking : internet ---> public ip eth0 eth1 private ip --> mail.server1.com private= ip eth0 eth1 private ip ---> lan --> mail.serve= r2.com private ip eth0 eth1 private ip ---> lan --> mail.serve= r3.com private ip eth0 eth1 private ip ---> lan=20=20 The problem is that i have 3 names on the same public IP and i want to se= nd mail traffic to those servers which have private ips. I don't want to use smtp on the router with public ip , just redirrect na= me based to the machines behind accordingly. thank you very much for your help, Danila Octavian=20 ----- Original Message -----=20 From: Danila Octavian=20 To: netfilter@lists.netfilter.org=20 Sent: Monday, July 26, 2004 11:40 AM Subject: Hostname with DNAT ? {OK} hello, I was wondering if you can guide me how to deal with my situation : I want to do something like :=20 read carefully this rule: $IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -d mail.server1.com --dpo= rt 25 -j DNAT --to 192.168.14.254:25 From now on, when the packet arrives the FORWARD chain of the filter ta= ble, it is not destinated to mail.server1.com anymore, since you have just = changed its destination IP with the rule above. it is destined to 192.168.1= 4.254. the '-d IP' in the rule bellow is wrong: $IPTABLES -A FORWARD -i eth0 -p tcp -d mail1.server.com --dport 25 -j A= CCEPT You should write instead: $IPTABLES -A FORWARD -i eth0 -p tcp -d 192.168.14.254 --dport 25 -j ACC= EPT did you got it? This applies for all these rules bellow: $IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -d mail.server2.com --dpo= rt 25 -j DNAT --to 192.168.14.251:25 $IPTABLES -A FORWARD -i eth0 -p tcp -d mail.server2.com(wrong) --dport = 25 -j ACCEPT $IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -d server3.com --dport 25= -j DNAT --to 192.168.14.253:25 $IPTABLES -A FORWARD -i eth0 -p tcp -d server3.com(wrong) --dport 25 -j= ACCEPT $IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -d mail.server3.com --dpo= rt 25 -j DNAT --to 192.168.14.253:25 $IPTABLES -A FORWARD -i eth0 -p tcp -d mail.server3.com(wrong) --dport = 25 -j ACCEPT Is posibble to use names instead of IP like in my situation ?=20 Yes, it is *possible*. It depends of whether your firewall can access t= he DNS server when it is loading those rules. In my firewall, when it is loading the PREROUTING rules, it didn't load= the INPUT and OUTPUT rules yet, so it is not permitted to send nor receive= any packet, so it can't contact the DNS server to resolve names. In my firewall I just load the FORWARD rules after i have loaded the IN= PUT and OUTPUT chains, so my firewall already can access the DNS server. hope it helps, bruno --=20 This message has been scanned for viruses and=20 dangerous content, and is believed to be clean.=20 Service.Agress.Ro E-Mail Scanning Service.=20 --=20 This message has been scanned for viruses and dangerous content, and is believed to be clean. Service.Agress.Ro E-Mail Scanning Service ------=_NextPart_000_0168_01C47483.CF5CA6B0 Content-Type: text/html; charset="iso-8859-2" Content-Transfer-Encoding: quoted-printable
 
Hi Danila, there are some error in your = rules,=20 first i'll correct them, then i'll tell you about using names
 
I know the rules were wrong ... i was in= a rush=20 ... u are right, but i was trying to do something else. I will give my se= tup=20 just to see what i was asking :
 
internet ---> public ip eth0 eth1 pri= vate ip=20 --> mail.server1.com private ip eth0 eth1 private ip --->=20 lan
          &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;         =20 --> mail.server2.com private ip eth0 eth1 private ip --->=20 lan
          &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;          -->&nbs= p;mail.server3.com=20 private ip eth0 eth1 private ip ---> lan 
The problem is that i have 3 names on th= e same=20 public IP and i want to send mail traffic to those servers which have pri= vate=20 ips.
I don't want to use smtp on the router w= ith=20 public ip , just redirrect name based to the machines behind=20 accordingly.
thank you very much for your help,
 
Danila Octavian 
----- Original Message -----
F= rom:=20 Danila Octavian
To: netfilter@lists.netfilter= .org=20
Sent: Monday, July 26, 2004 11:4= 0=20 AM
Subject: Hostname with DNAT ?=20 {OK}

hello,
 
I was wondering if you can guide me ho= w to deal=20 with my situation :
I want to do something like : <= /DIV>
 
read carefully this=20 rule:
$IPTABLES -A PREROUTING -t nat -i eth0= -p tcp=20 -d mail.server1.com --dport 25 -j DNAT --to 192.168.14.254:25
From now on, whe= n the=20 packet arrives the FORWARD chain of the filter table, it is not=20 destinated to mail.server1.com anymore, since you have just changed its destination IP= with the=20 rule above. it is destined to 192.168.14.254.
the '-d IP' in t= he rule=20 bellow is wrong:
$IPTABLES -A FORWARD -i eth0 -p tcp=20 -d mail1.server.com --dport 25 -j ACCEPT
You should write=20 instead:
$IPTABLES -A FORWARD -= i eth0 -p=20 tcp -d 192.168.14.254 --dport 25 -j ACCEPT
 
did you got it?=
This applies for all t= hese rules=20 bellow:
 
$IPTABLES -A PREROUTING -t nat -i eth0= -p tcp=20 -d mail.server2.com --dport 25 -j DNAT --to 192.168.14.251:25
$IPTAB= LES=20 -A FORWARD -i eth0 -p tcp -d mail.server2.com(wrong) --dport 25 -j ACCEPT
$IPTABLES -A PREROUTING -t nat -i eth0= -p tcp=20 -d server3.com --dport 25 -j DNAT --to 192.168.14.253:25
$IPTABLES -= A=20 FORWARD -i eth0 -p tcp -d server3.com(wrong)=20 --dport 25 -j ACCEPT
$IPTABLES -A PREROUTING -t nat -i eth0 -p tcp -= d=20 mail.server3.com --dport 25 -j DNAT --to 192.168.14.253:25
$IPTABLES= -A=20 FORWARD -i eth0 -p tcp -d mail.server3.com(wrong)= =20 --dport 25 -j ACCEPT
 
Is posibble to use names instead of IP= like in=20 my situation ?
Yes, it is *possible*.= It=20 depends of whether your firewall can access the DNS server when it= is=20 loading those rules.
In my firewall, when i= t is=20 loading the PREROUTING rules, it didn't load the INPUT and OUTPUT rules= yet,=20 so it is not permitted to send nor receive any packet, so it can't cont= act=20 the DNS server to resolve names.
 
In my firewall I just = load the=20 FORWARD rules after i have loaded the INPUT and OUTPUT chains, so my=20 firewall already can access the DNS server.
 
hope it helps,<= /DIV>
bruno

--
This message has been = scanned=20 for viruses and
dangerous content, and is believed to be clean.
<= A=20 href=3D"http://service.agress.ro/">Service.Agress.Ro E-Mail Scanning= =20 Service.
--=20
This message has been scanned for viruses and
dangerous content, and is believed to be clean.
Service.Agress.Ro E-Mail Sc= anning Service. ------=_NextPart_000_0168_01C47483.CF5CA6B0--