DNAT/SNAT stuff

DNAT/SNAT stuff

[mdew]

current setup, 

$IPTABLES -t nat -A PREROUTING -i eth0 -d 210.54.175.12 -p tcp --dport
4661 -j DNAT --to 10.0.0.3
$IPTABLES -t nat -A PREROUTING -i eth0 -d 210.54.175.12 -p tcp --dport
4662 -j DNAT --to 10.0.0.3
$IPTABLES -t nat -A POSTROUTING -o eth0 -s 10.0.0.3 -p tcp --sport 4661
-j SNAT --to 210.54.175.12
$IPTABLES -t nat -A POSTROUTING -o eth0 -s 10.0.0.3 -p tcp --sport 4662
-j SNAT --to 210.54.175.12
$IPTABLES -t nat -A PREROUTING -i eth0 -d 210.54.175.12 -p udp --dport
4665 -j DNAT --to 10.0.0.3
$IPTABLES -t nat -A PREROUTING -i eth0 -d 210.54.175.12 -p udp --dport
4672 -j DNAT --to 10.0.0.3
$IPTABLES -t nat -A POSTROUTING -o eth0 -s 10.0.0.3 -p udp --sport 4665
-j SNAT --to 210.54.175.12
$IPTABLES -t nat -A POSTROUTING -o eth0 -s 10.0.0.3 -p udp --sport 4672
-j SNAT --to 210.54.175.12

i would like specify 10.0.0.x instead of 10.0.0.3, how is this done?

and some problems i had attempting it..

Try `iptables -h' or 'iptables --help' for more information.
iptables v1.2.6a: Bad IP address `10.0.0.0/24'
iptables v1.2.6a: host/network `10.0.0.3-10.0.0.8' not found
Try `iptables -h' or 'iptables --help' for more information.

cc: please :)
-- 
mdew <mdew@orcon.net.nz>

Re: DNAT/SNAT stuff

[Francois LE BOURDELLES]

Hello ,

I just posted a similar question related to the same subject :
nating a full subnet (as described in the NAT howto) that doesn't seems
to work !
in fact it seems that the --to A.B.C.D/X fromat is not implemented (or
has been removed ?)

I'm waiting for a response ... from the list or the authors ....

Regards.

Le jeu 08/05/2003 à 11:39, mdew a écrit :
> current setup, 
> 
> $IPTABLES -t nat -A PREROUTING -i eth0 -d 210.54.175.12 -p tcp --dport
> 4661 -j DNAT --to 10.0.0.3
> $IPTABLES -t nat -A PREROUTING -i eth0 -d 210.54.175.12 -p tcp --dport
> 4662 -j DNAT --to 10.0.0.3
> $IPTABLES -t nat -A POSTROUTING -o eth0 -s 10.0.0.3 -p tcp --sport 4661
> -j SNAT --to 210.54.175.12
> $IPTABLES -t nat -A POSTROUTING -o eth0 -s 10.0.0.3 -p tcp --sport 4662
> -j SNAT --to 210.54.175.12
> $IPTABLES -t nat -A PREROUTING -i eth0 -d 210.54.175.12 -p udp --dport
> 4665 -j DNAT --to 10.0.0.3
> $IPTABLES -t nat -A PREROUTING -i eth0 -d 210.54.175.12 -p udp --dport
> 4672 -j DNAT --to 10.0.0.3
> $IPTABLES -t nat -A POSTROUTING -o eth0 -s 10.0.0.3 -p udp --sport 4665
> -j SNAT --to 210.54.175.12
> $IPTABLES -t nat -A POSTROUTING -o eth0 -s 10.0.0.3 -p udp --sport 4672
> -j SNAT --to 210.54.175.12
> 
> i would like specify 10.0.0.x instead of 10.0.0.3, how is this done?
> 
> and some problems i had attempting it..
> 
> Try `iptables -h' or 'iptables --help' for more information.
> iptables v1.2.6a: Bad IP address `10.0.0.0/24'
> iptables v1.2.6a: host/network `10.0.0.3-10.0.0.8' not found
> Try `iptables -h' or 'iptables --help' for more information.
> 
> cc: please :)
-- 
Francois LE BOURDELLES <flebourdelles@free.fr>

Re: DNAT/SNAT stuff

[P.Italiaander]

Op zondag 11 mei 2003 11:20, schreef Francois LE BOURDELLES:
> Hello ,
>
> I just posted a similar question related to the same subject :
> nating a full subnet (as described in the NAT howto) that doesn't seems
> to work !
> in fact it seems that the --to A.B.C.D/X fromat is not implemented (or
> has been removed ?)
>
> I'm waiting for a response ... from the list or the authors ....
>
> Regards.
>
> Le jeu 08/05/2003 à 11:39, mdew a écrit :
> > current setup,
> >
> > $IPTABLES -t nat -A PREROUTING -i eth0 -d 210.54.175.12 -p tcp --dport
> > 4661 -j DNAT --to 10.0.0.3
> > $IPTABLES -t nat -A PREROUTING -i eth0 -d 210.54.175.12 -p tcp --dport
> > 4662 -j DNAT --to 10.0.0.3
> > $IPTABLES -t nat -A POSTROUTING -o eth0 -s 10.0.0.3 -p tcp --sport 4661
> > -j SNAT --to 210.54.175.12
> > $IPTABLES -t nat -A POSTROUTING -o eth0 -s 10.0.0.3 -p tcp --sport 4662
> > -j SNAT --to 210.54.175.12
> > $IPTABLES -t nat -A PREROUTING -i eth0 -d 210.54.175.12 -p udp --dport
> > 4665 -j DNAT --to 10.0.0.3
> > $IPTABLES -t nat -A PREROUTING -i eth0 -d 210.54.175.12 -p udp --dport
> > 4672 -j DNAT --to 10.0.0.3
> > $IPTABLES -t nat -A POSTROUTING -o eth0 -s 10.0.0.3 -p udp --sport 4665
> > -j SNAT --to 210.54.175.12
> > $IPTABLES -t nat -A POSTROUTING -o eth0 -s 10.0.0.3 -p udp --sport 4672
> > -j SNAT --to 210.54.175.12
> >
> > i would like specify 10.0.0.x instead of 10.0.0.3, how is this done?
> >
> > and some problems i had attempting it..
> >
> > Try `iptables -h' or 'iptables --help' for more information.
> > iptables v1.2.6a: Bad IP address `10.0.0.0/24'
> > iptables v1.2.6a: host/network `10.0.0.3-10.0.0.8' not found
> > Try `iptables -h' or 'iptables --help' for more information.
> >
> > cc: please :)

I tested this rule and works fine:

$IPTABLES -t nat -A POSTROUTING -o eth0 -s 10.0.0.0/24 -p udp --sport 4665
 -j SNAT --to 210.54.175.12

Pascal

Re: DNAT/SNAT stuff

[Francois LE BOURDELLES]

[-- Attachment #1: Type: text/plain, Size: 1469 bytes --]

Hello,

Thanks to Laurent Luyckx, here could be something to help you for subnet
nating :
(see attached)

Regards.

Le jeu 08/05/2003 à 11:39, mdew a écrit :
> current setup, 
> 
> $IPTABLES -t nat -A PREROUTING -i eth0 -d 210.54.175.12 -p tcp --dport
> 4661 -j DNAT --to 10.0.0.3
> $IPTABLES -t nat -A PREROUTING -i eth0 -d 210.54.175.12 -p tcp --dport
> 4662 -j DNAT --to 10.0.0.3
> $IPTABLES -t nat -A POSTROUTING -o eth0 -s 10.0.0.3 -p tcp --sport 4661
> -j SNAT --to 210.54.175.12
> $IPTABLES -t nat -A POSTROUTING -o eth0 -s 10.0.0.3 -p tcp --sport 4662
> -j SNAT --to 210.54.175.12
> $IPTABLES -t nat -A PREROUTING -i eth0 -d 210.54.175.12 -p udp --dport
> 4665 -j DNAT --to 10.0.0.3
> $IPTABLES -t nat -A PREROUTING -i eth0 -d 210.54.175.12 -p udp --dport
> 4672 -j DNAT --to 10.0.0.3
> $IPTABLES -t nat -A POSTROUTING -o eth0 -s 10.0.0.3 -p udp --sport 4665
> -j SNAT --to 210.54.175.12
> $IPTABLES -t nat -A POSTROUTING -o eth0 -s 10.0.0.3 -p udp --sport 4672
> -j SNAT --to 210.54.175.12
> 
> i would like specify 10.0.0.x instead of 10.0.0.3, how is this done?
> 
> and some problems i had attempting it..
> 
> Try `iptables -h' or 'iptables --help' for more information.
> iptables v1.2.6a: Bad IP address `10.0.0.0/24'
> iptables v1.2.6a: host/network `10.0.0.3-10.0.0.8' not found
> Try `iptables -h' or 'iptables --help' for more information.
> 
> cc: please :)
-- 
Francois LE BOURDELLES <flebourdelles@free.fr>

[-- Attachment #2: Type: message/rfc822, Size: 2241 bytes --]

From: Laurent Luyckx <lololuy@tiscali.be>
To: Francois LE BOURDELLES <flebourdelles@free.fr>
Cc: netfilter@lists.netfilter.org
Subject: Re: How to nat a full subnet ?
Date: 11 May 2003 13:03:00 +0200
Message-ID: <1052650980.699.4.camel@laurent.luyckx.net>

Have look a the NETMAP patch from p-o-m.
It creates a static 1:1 mapping of the network address.

(http://www.netfilter.org/documentation/pomlist/pom-combined.html#NETMAP)

Cheers.

On Sun, 2003-05-11 at 10:44, Francois LE BOURDELLES wrote:
> Hello happy netfilter users,
> 
> First i use kernel 2.4.20 patch-o-matic'ed and iptables 2.4.8
> I have to SNAT an DNAT a full subnet (199.1.4.0/0 (internal address
> plan) to 1998.1.4.0/0 (external view))
> so I tried to use the command :
> 
> iptables -t nat -A POSTROUTING -s 199.1.4.0/24 --to 199.1.4.0/24 -o
> tunnel0 -j SNAT
> (tunnel0 is a GRE typed tunnel)
> 
> as the NAT Howto page shows (NAT-HOWTO-6.html).
> 
> The aim is to have per exemple : 199.1.4.13 source changed to 198.1.4.13
> 
> but this command is rejected :
> 
> As I understand the sources (iptables and kernel) this is because the
> --to only accept single IP address
> or a range of IP-address, the last one for a pool automatic selection
> [And I do not know for what this could be used !).
> 
> DO THE HOW-TO PAGES HAVE TO BE UPDATED (removing of the full subnet SNAT
> and DNAT) ... or the iptables/ipfilter updated ?
> 
> Regards.
-- 
Laurent Luyckx <lololuy@tiscali.be>