Nat with a dynamic IP

Nat with a dynamic IP

[Peter Marshall]

Hi.  I was wondering if someone could tell me what a good way is to set up
DNAT and SNAT on a firewall if the external IP is not static ....

I have a RH 8 box with 2 nic cards.  I have it working right now ... sort
of.  But I have to manually update my iptables file every time my external
ip changes ......

Any suggestions ?

Thanks

Peter Marshall

Re: Nat with a dynamic IP

[Thorsten Scherf]

>Hi.  I was wondering if someone could tell me what a good way is to set up
>DNAT and SNAT on a firewall if the external IP is not static ....

Do not use SNAT, use Maquerading. You don't have to know your external IP 
here:

iptables -t nat -A POSTROUTING -s $INT_NET -o $EXT_DEV -j MASQ

DNAT is also very simple, don't specify your external IP in DNAT Rule, just 
the Destination Port:

iptables -t nat -A PREROUTING -p tcp --dport 25 -i $EXT_DEV -j DNAT 
--to-destination $SMTP_SERVER


Greetings,

Thorsten Scherf,
RHCE, RHCX

Re: Nat with a dynamic IP

[Peter Marshall]

That is a pretty good solution for the SNAT.  I never thought about MASQ.
However .... I am not sure if the DNAT is the best solution ....  WHat if
you had multiple ip numbers on the external card ....

More importantly, what about trying to connect directly to the firewall from
an external address.

----- Original Message -----
From: "Thorsten Scherf" <tscherf@web.de>
To: "Peter Marshall" <peter.marshall@caris.com>
Cc: <netfilter@lists.netfilter.org>
Sent: Friday, September 05, 2003 11:05 AM
Subject: Re: Nat with a dynamic IP


> >Hi.  I was wondering if someone could tell me what a good way is to set
up
> >DNAT and SNAT on a firewall if the external IP is not static ....
>
> Do not use SNAT, use Maquerading. You don't have to know your external IP
> here:
>
> iptables -t nat -A POSTROUTING -s $INT_NET -o $EXT_DEV -j MASQ
>
> DNAT is also very simple, don't specify your external IP in DNAT Rule,
just
> the Destination Port:
>
> iptables -t nat -A PREROUTING -p tcp --dport 25 -i $EXT_DEV -j DNAT
> --to-destination $SMTP_SERVER
>
>
> Greetings,
>
> Thorsten Scherf,
> RHCE, RHCX
>
>
>
>

Re: Nat with a dynamic IP

[Ramin Dousti]

On Fri, Sep 05, 2003 at 11:36:09AM -0300, Peter Marshall wrote:

> That is a pretty good solution for the SNAT.  I never thought about MASQ.
> However .... I am not sure if the DNAT is the best solution ....  WHat if
> you had multiple ip numbers on the external card ....

and they're all dynamic? Give us an example...

Ramin

> More importantly, what about trying to connect directly to the firewall from
> an external address.

RE: Nat with a dynamic IP

[Daniel Chemko]

Damn, guys, if you could set me up with a fantastic script that can do
multiple DHCP subscriptions on a single NIC, I could throw away my all
4-port NIC's. I'll hear offers for the cards 'after' I get this script
:-)



-----Original Message-----
From: Ramin Dousti [mailto:ramin@cannon.eng.us.uu.net] 
Sent: Friday, September 05, 2003 10:11 AM
To: Peter Marshall
Cc: Thorsten Scherf; netfilter@lists.netfilter.org
Subject: Re: Nat with a dynamic IP

On Fri, Sep 05, 2003 at 11:36:09AM -0300, Peter Marshall wrote:

> That is a pretty good solution for the SNAT.  I never thought about
MASQ.
> However .... I am not sure if the DNAT is the best solution ....  WHat
if
> you had multiple ip numbers on the external card ....

and they're all dynamic? Give us an example...

Ramin

> More importantly, what about trying to connect directly to the
firewall from
> an external address.

Re: Nat with a dynamic IP

[Peter Marshall]

LOL.  I did not say it was possibel. I was looking for a way to do it.  I
guess I am not as concerened with getting it to work with multiple external
interfaces ....  But mostly with the second part of my question ( which by
the way was ...)

"More importantly, what about trying to connect directly to the
firewall from an external address"

I guess what I am really getting at is that if I set up DNAT the way
suggested  (see below) then I am not sure how I would be able to ssh to both
the firewall and a box inside the firewall.  Is the only way to do this to
ssh to the firewall and then ssh to a box inside the firewall ?

( this was the suggestion.  btw, I am not using a mail server, it was just
in the solution)
iptables -t nat -A PREROUTING -p tcp --dport 25 -i $EXT_DEV -j DNAT
    --to-destination $SMTP_SERVER

My setup would be something like this
iptables -t nat -A PREROUTING -p tcp --dport 22 -i$EXT_DEV -j DNAT
       --to-destination $InternalIPofFirewall
( this would direct all ssh connections on port 22 to the firewall)

Is the only other possibility (other than sshing to the firewall first and
then to the internal box) to have another port listen on a high port, and
set up my internal box to listen on that high port for ssh ???


Thanks again, and sorry for the long confusing email ....

----- Original Message -----
From: "Daniel Chemko" <dchemko@smgtec.com>
To: "Ramin Dousti" <ramin@cannon.eng.us.uu.net>; "Peter Marshall"
<peter.marshall@caris.com>
Cc: "Thorsten Scherf" <tscherf@web.de>; <netfilter@lists.netfilter.org>
Sent: Friday, September 05, 2003 2:16 PM
Subject: RE: Nat with a dynamic IP


> Damn, guys, if you could set me up with a fantastic script that can do
> multiple DHCP subscriptions on a single NIC, I could throw away my all
> 4-port NIC's. I'll hear offers for the cards 'after' I get this script
> :-)
>
>
>
> -----Original Message-----
> From: Ramin Dousti [mailto:ramin@cannon.eng.us.uu.net]
> Sent: Friday, September 05, 2003 10:11 AM
> To: Peter Marshall
> Cc: Thorsten Scherf; netfilter@lists.netfilter.org
> Subject: Re: Nat with a dynamic IP
>
> On Fri, Sep 05, 2003 at 11:36:09AM -0300, Peter Marshall wrote:
>
> > That is a pretty good solution for the SNAT.  I never thought about
> MASQ.
> > However .... I am not sure if the DNAT is the best solution ....  WHat
> if
> > you had multiple ip numbers on the external card ....
>
> and they're all dynamic? Give us an example...
>
> Ramin
>
> > More importantly, what about trying to connect directly to the
> firewall from
> > an external address.
>
>

Re: Nat with a dynamic IP

[Ramin Dousti]

Here is an idea, It might cost you some vlanning efforts on both the
dhcp client and the dhcp server:

vconfig add eth2 10
vconfig add eth2 11
vconfig add eth2 12
vconfig add eth2 13

dhcpcd eth2.10
dhcpcd eth2.11
dhcpcd eth2.12
dhcpcd eth2.13

You can keep the NIC's :-)

Ramin


On Fri, Sep 05, 2003 at 10:16:41AM -0700, Daniel Chemko wrote:

> Damn, guys, if you could set me up with a fantastic script that can do
> multiple DHCP subscriptions on a single NIC, I could throw away my all
> 4-port NIC's. I'll hear offers for the cards 'after' I get this script
> :-)
> 
> 
> 
> -----Original Message-----
> From: Ramin Dousti [mailto:ramin@cannon.eng.us.uu.net] 
> Sent: Friday, September 05, 2003 10:11 AM
> To: Peter Marshall
> Cc: Thorsten Scherf; netfilter@lists.netfilter.org
> Subject: Re: Nat with a dynamic IP
> 
> On Fri, Sep 05, 2003 at 11:36:09AM -0300, Peter Marshall wrote:
> 
> > That is a pretty good solution for the SNAT.  I never thought about
> MASQ.
> > However .... I am not sure if the DNAT is the best solution ....  WHat
> if
> > you had multiple ip numbers on the external card ....
> 
> and they're all dynamic? Give us an example...
> 
> Ramin
> 
> > More importantly, what about trying to connect directly to the
> firewall from
> > an external address.
> 

Re: Nat with a dynamic IP

[Ramin Dousti]

Most of the time the utilities which assign you a dynamic IP address,
have a post-processing hook. You can use this hook to correct you
iptables rules...

Ramin

On Fri, Sep 05, 2003 at 02:47:18PM -0300, Peter Marshall wrote:

> LOL.  I did not say it was possibel. I was looking for a way to do it.  I
> guess I am not as concerened with getting it to work with multiple external
> interfaces ....  But mostly with the second part of my question ( which by
> the way was ...)
> 
> "More importantly, what about trying to connect directly to the
> firewall from an external address"
> 
> I guess what I am really getting at is that if I set up DNAT the way
> suggested  (see below) then I am not sure how I would be able to ssh to both
> the firewall and a box inside the firewall.  Is the only way to do this to
> ssh to the firewall and then ssh to a box inside the firewall ?
> 
> ( this was the suggestion.  btw, I am not using a mail server, it was just
> in the solution)
> iptables -t nat -A PREROUTING -p tcp --dport 25 -i $EXT_DEV -j DNAT
>     --to-destination $SMTP_SERVER
> 
> My setup would be something like this
> iptables -t nat -A PREROUTING -p tcp --dport 22 -i$EXT_DEV -j DNAT
>        --to-destination $InternalIPofFirewall
> ( this would direct all ssh connections on port 22 to the firewall)
> 
> Is the only other possibility (other than sshing to the firewall first and
> then to the internal box) to have another port listen on a high port, and
> set up my internal box to listen on that high port for ssh ???
> 
> 
> Thanks again, and sorry for the long confusing email ....
> 
> ----- Original Message -----
> From: "Daniel Chemko" <dchemko@smgtec.com>
> To: "Ramin Dousti" <ramin@cannon.eng.us.uu.net>; "Peter Marshall"
> <peter.marshall@caris.com>
> Cc: "Thorsten Scherf" <tscherf@web.de>; <netfilter@lists.netfilter.org>
> Sent: Friday, September 05, 2003 2:16 PM
> Subject: RE: Nat with a dynamic IP
> 
> 
> > Damn, guys, if you could set me up with a fantastic script that can do
> > multiple DHCP subscriptions on a single NIC, I could throw away my all
> > 4-port NIC's. I'll hear offers for the cards 'after' I get this script
> > :-)
> >
> >
> >
> > -----Original Message-----
> > From: Ramin Dousti [mailto:ramin@cannon.eng.us.uu.net]
> > Sent: Friday, September 05, 2003 10:11 AM
> > To: Peter Marshall
> > Cc: Thorsten Scherf; netfilter@lists.netfilter.org
> > Subject: Re: Nat with a dynamic IP
> >
> > On Fri, Sep 05, 2003 at 11:36:09AM -0300, Peter Marshall wrote:
> >
> > > That is a pretty good solution for the SNAT.  I never thought about
> > MASQ.
> > > However .... I am not sure if the DNAT is the best solution ....  WHat
> > if
> > > you had multiple ip numbers on the external card ....
> >
> > and they're all dynamic? Give us an example...
> >
> > Ramin
> >
> > > More importantly, what about trying to connect directly to the
> > firewall from
> > > an external address.
> >
> >

RE: Nat with a dynamic IP

[Daniel Chemko]

It is to an ISP, so no beans...

-----Original Message-----
From: Ramin Dousti [mailto:ramin@cannon.eng.us.uu.net] 
Sent: Friday, September 05, 2003 12:14 PM
To: Daniel Chemko
Cc: Peter Marshall; Thorsten Scherf; netfilter@lists.netfilter.org
Subject: Re: Nat with a dynamic IP

Here is an idea, It might cost you some vlanning efforts on both the
dhcp client and the dhcp server:

vconfig add eth2 10
vconfig add eth2 11
vconfig add eth2 12
vconfig add eth2 13

dhcpcd eth2.10
dhcpcd eth2.11
dhcpcd eth2.12
dhcpcd eth2.13
 

Re: Nat with a dynamic IP

[Peter Marshall]

yep.  (but I wish I had access to their switches and vlans :)

Thanks for the tips.  everyone.

----- Original Message -----
From: "Daniel Chemko" <dchemko@smgtec.com>
To: "Ramin Dousti" <ramin@cannon.eng.us.uu.net>
Cc: "Peter Marshall" <peter.marshall@caris.com>; "Thorsten Scherf"
<tscherf@web.de>; <netfilter@lists.netfilter.org>
Sent: Friday, September 05, 2003 4:23 PM
Subject: RE: Nat with a dynamic IP


> It is to an ISP, so no beans...
>
> -----Original Message-----
> From: Ramin Dousti [mailto:ramin@cannon.eng.us.uu.net]
> Sent: Friday, September 05, 2003 12:14 PM
> To: Daniel Chemko
> Cc: Peter Marshall; Thorsten Scherf; netfilter@lists.netfilter.org
> Subject: Re: Nat with a dynamic IP
>
> Here is an idea, It might cost you some vlanning efforts on both the
> dhcp client and the dhcp server:
>
> vconfig add eth2 10
> vconfig add eth2 11
> vconfig add eth2 12
> vconfig add eth2 13
>
> dhcpcd eth2.10
> dhcpcd eth2.11
> dhcpcd eth2.12
> dhcpcd eth2.13
>
>

Re: Nat with a dynamic IP

[Jim Carter]

On Fri, 5 Sep 2003, Peter Marshall wrote:
> My setup would be something like this
> iptables -t nat -A PREROUTING -p tcp --dport 22 -i$EXT_DEV -j DNAT
>        --to-destination $InternalIPofFirewall
> ( this would direct all ssh connections on port 22 to the firewall)

Right, but if I remember the original configuration, the internal boxes are
all on non-routable IPs anyway, so the only one you can specify from the
global internet is the firewall's external address.  So this rule would not
be necessary.

> Is the only other possibility (other than sshing to the firewall first and
> then to the internal box) to have another port listen on a high port, and
> set up my internal box to listen on that high port for ssh ???

Right, you could use the firewall as a Janus host, or you could DNAT
special ports to be mapped to port 22 on frequently-used internal hosts.
Let's say 10000 is for smtp.caris.com, 10001 is for boss.caris.com, etc.
Then you do "ssh -p 10001 firewall.caris.com" (the external address), and
you have a ssh connection to "boss".  I would leave the internal machines
listening on port 22, and rely on DNAT to change 10000, 10001, etc. to 22
on the right host.

James F. Carter          Voice 310 825 2897    FAX 310 206 6673
UCLA-Mathnet;  6115 MSA; 405 Hilgard Ave.; Los Angeles, CA, USA 90095-1555
Email: jimc@math.ucla.edu  http://www.math.ucla.edu/~jimc (q.v. for PGP key)