Re: Bonding + NAT

[Raymond Leach <raymondl@knowledgefactory.co.za>]

[-- Attachment #1: Type: text/plain, Size: 3132 bytes --]

Maybe SNAT is not the right solution. Have a look at the ROUTE patch in
the netfilter POM.


On Fri, 2003-03-28 at 15:50, Eduardo Fernández González wrote:
> Hello.
> 
> In my university dorm we've got a private net with two subnets: I'll call one of them the servers subnet (10.1.5.0/24) because there are some servers (ftp, web, streaming, etc) and a couple of routers: one is a cisco router which provide us with internet access and the other one is a linux system which acts as a router between this subnet and the other subnet (10.1.7.0/24), which I'll refer as the students subnet, where there are about 250 hosts. 
> 
> The linux router is doing NAT, and it is a dhcp, ddns and pdc (primary domain controller) server too. The traffic between this subnets is very heavy because of the ftp server, so we decided to add two more ethernet cards to the linux router (4 in total) and configure bonding. But only the switches at the students subnet supported bonding, so now we have two cards (eth1 and eth3) showing the same ip (10.1.7.1) with bonding and the other two cards (eth0 and eth2) with two ips (10.1.5.4 and 10.1.5.3). Then, our idea was to force the traffic between the subnets to leave the router over eth2, and to make the rest of the traffic leave the router over eth0. At first, I thought the following nat rules were enough to implement this,
> 
> # iptables -t nat -A POSTROUTING -o eth2 -s 10.1.7.0/24 -d 10.1.5.0/24 -j SNAT --to-source 10.1.5.3
> # iptables -t nat -A POSTROUTING -o eth0 -s 10.1.7.0/24 -d ! 10.1.5.0/24 -j SNAT --to-source 10.1.5.4
> 
> but I was wrong: I was able to ping the internet from the students subnet, and the traffic left the router over the right interface, but I was unable to ping any host at the servers subnet. And the question is, am I wrong? Is it possible to implement what I've said via iptables? 
> 
> As a quick and dirty hack, we're using iproute2 to make all traffic between the students and the ftp leave the router over eth2, but what's bad on iproute2 is that you have to specify single hosts, not a whole network like 10.1.5.0/24. Moreover, you can't use rules of the kind -d ! 10.1.5.0/24, unlike with iptables. Is iptables the right approach to do this? Am i missing something?
> 
> Thank you very much in advance,
> 
> Eduardo Fernández
-- 
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
(  Raymond Leach                       )
 ) Knowledge Factory                  (
(                                      )
 ) Tel: +27 11 445 8100               (
(  Fax: +27 11 445 8101                )
 )                                    (
(  http://www.knowledgefactory.co.za/  )
 ) http://www.saptg.co.za/            (
(  http://www.mapnet.co.za/            )
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   o                                o
    o                              o
        .--.                  .--.
       | o_o|                |o_o |
       | \_:|                |:_/ |
      / /   \\              //   \ \
     ( |     |)            (|     | )
     /`\_   _/'\          /'\_   _/`\
     \___)=(___/          \___)=(___/


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]