From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Matthew Mileham" Subject: IPTABLES NAT Date: Wed, 10 Sep 2003 08:06:36 +0200 Sender: netfilter-admin@lists.netfilter.org Message-ID: <017601c37761$b1aeecb0$798014ac@matthew> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0173_01C37772.74EFDE40" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: Netfilter Mailing List This is a multi-part message in MIME format. ------=_NextPart_000_0173_01C37772.74EFDE40 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hi=20 I wonder if any body can help me ? I've got 2 Redhat 9 Linux Servers purely running iptables and only using = the NAT function I want to load balance over two boxes, I want to send traffic out the = one box and SNAT 57.24.224.242,=20 and return traffic to return to the second box and DNAT to = 172.20.128.121=20 If I send traffic over the one box and receive on the same box it works, = but when I split the traffic it doesn't work ! the rules are as follows=20 Box1=20 iptables -t nat -A POSTROUTING -o eth1 -s 172.20.128.121 -j SNAT --to = 57.24.224.242 Box2=20 iptables -t nat -A PREROUTING -i eth1 -d 57.24.224.242 -j DNAT --to = 172.20.128.121 Thanks=20 ------=_NextPart_000_0173_01C37772.74EFDE40 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Hi
 
I wonder if any body can help me = ?
 
I've got 2 Redhat 9 Linux Servers = purely=20 running iptables and only using the NAT function
 
I want to load balance over two boxes, = I=20 want to send traffic out the one box and SNAT=20 57.24.224.242, 
and return traffic to return to = the second=20 box and DNAT to=20 172.20.128.121 
 
If I send traffic over the one box and = receive on=20 the same box it works, but when I split the traffic it doesn't work=20 !
 
the rules are as follows
 
Box1
iptables -t nat -A POSTROUTING -o eth1 = -s=20 172.20.128.121 -j SNAT --to 57.24.224.242
 
Box2
iptables -t nat -A PREROUTING -i eth1 = -d=20 57.24.224.242 -j DNAT --to 172.20.128.121
 
Thanks
 
 
 
 
------=_NextPart_000_0173_01C37772.74EFDE40-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: "George Vieira" Subject: RE: IPTABLES NAT Date: Wed, 10 Sep 2003 16:18:44 +1000 Sender: netfilter-admin@lists.netfilter.org Message-ID: <09B04A55822EFF4DA48D2E0BB2941D4A15C293@wardrive.citadelcomputer.com.au> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C37763.62FE6454" Return-path: content-class: urn:content-classes:message Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: Matthew Mileham , Netfilter Mailing List This is a multi-part message in MIME format. ------_=_NextPart_001_01C37763.62FE6454 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Can you explain your network layout on this? =20 Are these 2 independant ISPs your connected through? -----Original Message----- From: Matthew Mileham [mailto:matthew@postbag.co.za] Sent: Wednesday, September 10, 2003 4:07 PM To: Netfilter Mailing List Subject: IPTABLES NAT =20 Box1=20 iptables -t nat -A POSTROUTING -o eth1 -s 172.20.128.121 -j SNAT --to = 57.24.224.242 =20 Box2=20 iptables -t nat -A PREROUTING -i eth1 -d 57.24.224.242 -j DNAT --to = 172.20.128.121 =20 =20 =20 =20 =20 ------_=_NextPart_001_01C37763.62FE6454 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Can=20 you explain your network layout on this?
 
Are=20 these 2 independant ISPs your connected through?
-----Original Message-----
From: Matthew Mileham=20 [mailto:matthew@postbag.co.za]
Sent: Wednesday, September = 10, 2003=20 4:07 PM
To: Netfilter Mailing List
Subject: = IPTABLES=20 NAT
 
Box1
iptables -t nat -A POSTROUTING -o = eth1 -s=20 172.20.128.121 -j SNAT --to 57.24.224.242
 
Box2
iptables -t nat -A PREROUTING -i eth1 = -d=20 57.24.224.242 -j DNAT --to 172.20.128.121
 
 
 
 
 
------_=_NextPart_001_01C37763.62FE6454-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jim Carter Subject: Re: IPTABLES NAT Date: Wed, 10 Sep 2003 09:04:08 -0700 (PDT) Sender: netfilter-admin@lists.netfilter.org Message-ID: References: <017601c37761$b1aeecb0$798014ac@matthew> Mime-Version: 1.0 Return-path: In-Reply-To: <017601c37761$b1aeecb0$798014ac@matthew> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: TEXT/PLAIN; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Matthew Mileham Cc: Netfilter Mailing List On Wed, 10 Sep 2003, Matthew Mileham wrote: > I've got 2 Redhat 9 Linux Servers purely running iptables and only using > the NAT function > I want to load balance over two boxes, I want to send traffic out the one > box and SNAT 57.24.224.242, and return traffic to return to the second > box and DNAT to 172.20.128.121 > If I send traffic over the one box and receive on the same box it works, > but when I split the traffic it doesn't work ! Suppose an internal machine originates a connection. Its initial packet goes out box 1 and a connection is recorded. If the outside world's answer came back to box 1, then box 1 could undo the SNAT and send the packet to the originator. But box 2 has no idea what's going on. If the answer goes through box 2, it either drops the packet if you have iptables -t filter -P FORWARD DROP iptables -t filter -A FORWARD -m state --state NEW,RELATED,ESTABLISHED \ -j ACCEPT because this is for a connection it has no record of, or it might forward the packet to box 1 which maybe, possibly, could recognize and correctly forward it, if the filter rules had the right security holes. The effect is similar if an outside machine originates the connection to your internal host. It's "accepted wisdom" that the load on the machine from forwarding packets is very low, assuming your netfilter rules aren't too baroque and assuming you avoid logging most packets (log only the ones you drop). Your kind of load sharing would only be justified if you had extreme datarates like a fully saturated OC-12 link or something like that. If that were really true, I would load-share by splitting the internal subnet and giving one gateway machine to each half. James F. Carter Voice 310 825 2897 FAX 310 206 6673 UCLA-Mathnet; 6115 MSA; 405 Hilgard Ave.; Los Angeles, CA, USA 90095-1555 Email: jimc@math.ucla.edu http://www.math.ucla.edu/~jimc (q.v. for PGP key) From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Lohan Spies" Subject: iptables nat Date: Mon, 13 Oct 2003 11:27:39 +0200 Sender: netfilter-admin@lists.netfilter.org Message-ID: Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_00A9_01C3917D.0430C370" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter@lists.netfilter.org This is a multi-part message in MIME format. ------=_NextPart_000_00A9_01C3917D.0430C370 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Hi all, How can i configure a nat rule so that the original ip address is sended to the nat server instead of the ip of the fw? Thanks, Lohan Spies Systems Administrator CSA / DBA / MCP IQ Business Group Tel: +27 12 521 7309 Fax: +27 12 541 3441 Cell: +27 83 258 2698 l.spies@petzetakis-africa.co.za CONFIDENTIALITY CAUTION: If you have received this communication in error, please note that it is intended for the addressee only, is private and confidential and dissemination or copying prohibited. Please notify us immediately by e-mail and return the original message. We cannot assure that the integrity of this communication has been maintained nor that it is free of errors, virus, interception or interference. Thank you ------=_NextPart_000_00A9_01C3917D.0430C370 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Message
Hi=20 all,
 
How = can i configure=20 a nat rule so that the original ip address is sended to the nat server = instead=20 of the ip of the fw?
 
Thanks,
 
Lohan Spies
Systems Administrator CSA / DBA /=20 MCP
IQ Business=20 Group
Tel: +27 = 12 521=20 7309
Fax: +27 = 12 541=20 3441
 Cell: +27 = 83 258=20 2698
 l.spies@petzetakis-africa= .co.za


 

 

CONFIDENTIALITY CAUTION: If you have received this communication in error, please note that it is intended for the addressee only, is private and confidential and dissemination or copying prohibited. Please notify us immediately by e-mail and return the original message. We cannot assure that the integrity of this communication has been maintained nor that it is free of errors, virus, interception or interference. Thank you ------=_NextPart_000_00A9_01C3917D.0430C370--