map internal ip

map internal ip

[Omar Armas]

I have the following config:

(public ip)
eth0
Firewall
eth1 (150.50.53.4)
|
|
|
148.145.133.1 (vpn router)
|
|
150.50.57.0/24 
(LAN, including a server with 150.50.57.2)

*Class 150.50.57.0/24 is routed to 148.245.164.1

I want that when people(from eth1 lan) goes to 150.50.53.5, be
redirected to 150.50.57.2.

I tried:

iptables -t nat -A PREROUTING 150.50.53.5 -j DNAT --to-destination
150.50.57.2


But doesn't seem to be working. Any idea if it is possible and how to do
it?


Omar

Re: map internal ip

[Antony Stone]

On Friday 19 March 2004 6:56 pm, Omar Armas wrote:

> I have the following config:
>
> (public ip)
> eth0
> Firewall
> eth1 (150.50.53.4)
>
> 148.145.133.1 (vpn router)
>
> 150.50.57.0/24
> (LAN, including a server with 150.50.57.2)
>
> *Class 150.50.57.0/24 is routed to 148.245.164.1
>
> I want that when people(from eth1 lan) goes to 150.50.53.5, be
> redirected to 150.50.57.2.
>
> I tried:
>
> iptables -t nat -A PREROUTING 150.50.53.5 -j DNAT --to-destination
> 150.50.57.2
>
> But doesn't seem to be working. Any idea if it is possible and how to do
> it?

That looks correct.   Do you have a suitable FORWARD rule to allow the 
translated packets through the firewall?

Does 150.50.57.2 know how to route the replies back again (through the 
firewall)?

How are you testing?

I'm not sure I understand the significance of the "VPN router" shown on your 
diagram with only a single IP address - can you explain further what this 
means, and what is its relevance to the setup?

Regards,

Antony.

-- 
Never write it in Perl if you can do it in Awk.
Never do it in Awk if sed can handle it.
Never use sed when tr can do the job.
Never invoke tr when cat is sufficient.
Avoid using cat whenever possible.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: map internal ip [2]

[Antony Stone]

On Friday 19 March 2004 6:56 pm, Omar Armas wrote:

> I have the following config:
>
> (public ip)
> eth0
> Firewall
> eth1 (150.50.53.4)
>
> 148.145.133.1 (vpn router)
>
> 150.50.57.0/24
> (LAN, including a server with 150.50.57.2)
>
> *Class 150.50.57.0/24 is routed to 148.245.164.1

I forgot to ask - where does 148.245.164.1 fit into the above diagram?

Antony.

-- 
Christmas was just an opportunity to upgrade to kernel 2.6 while no-one was 
around to notice the downtime.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: map internal ip [2]

[Omar Armas]

On Fri, 2004-03-19 at 13:21, Antony Stone wrote:
> On Friday 19 March 2004 6:56 pm, Omar Armas wrote:
> 
> > I have the following config:
> >
> > (public ip)
> > eth0
> > Firewall
> > eth1 (150.50.53.4)
> >
> > 148.145.133.1 (vpn router)
> >
> > 150.50.57.0/24
> > (LAN, including a server with 150.50.57.2)
> >
> > *Class 150.50.57.0/24 is routed to 148.245.164.1
> 
> I forgot to ask - where does 148.245.164.1 fit into the above diagram?
> 


eth0=148.245.164.2, from that interface it sees the vpn
router(148.245.164.1).

Omar

Re: map internal ip [2]

[Antony Stone]

On Friday 19 March 2004 7:42 pm, Omar Armas wrote:

> On Fri, 2004-03-19 at 13:21, Antony Stone wrote:
> > On Friday 19 March 2004 6:56 pm, Omar Armas wrote:
> > > I have the following config:
> > >
> > > (public ip)
> > > eth0
> > > Firewall
> > > eth1 (150.50.53.4)
> > >
> > > 148.145.133.1 (vpn router)
> > >
> > > 150.50.57.0/24
> > > (LAN, including a server with 150.50.57.2)
> > >
> > > *Class 150.50.57.0/24 is routed to 148.245.164.1
> >
> > I forgot to ask - where does 148.245.164.1 fit into the above diagram?
>
> eth0=148.245.164.2, from that interface it sees the vpn
> router(148.245.164.1).

Now I'm confused.   Please supply a more complete diagram, showing all the 
relevant IP addresses, so I can see where they are in relation to one 
another.

Regards,

Antony.

-- 
This email is intended for the use of the individual addressee(s) named above 
and may contain information that is confidential, privileged or unsuitable 
for overly sensitive persons with low self-esteem, no sense of humour, or 
irrational religious beliefs.

If you have received this email in error, you are required to shred it 
immediately, add some nutmeg, three egg whites and a dessertspoonful of 
caster sugar.   Whisk until soft peaks form, then place in a warm oven for 40 
minutes.   Remove promptly and let stand for 2 hours before adding some 
decorative kiwi fruit and cream.   Then notify me immediately by return email 
and eat the original message.

Re: map internal ip

[Mehmet AK]

hi Antony.

yo can do this with iproute2  .  You have to mark TCP packet with iptables
like an example

ip route add default via 148.245.164.1 table 40 # this is your default
router
iptables -t mangle -I PREROUTING -d 150.50.53.5  -j MARK --set-mark 0x10  #
mark who goes 150.50.53.5
ip rule add fwmark 0x10 table 40      #


best regards

Mehmet AK



----- Original Message ----- 
From: "Antony Stone" <Antony@Soft-Solutions.co.uk>
To: <netfilter@lists.netfilter.org>
Sent: Friday, March 19, 2004 10:18 PM
Subject: Re: map internal ip


> On Friday 19 March 2004 6:56 pm, Omar Armas wrote:
>
> > I have the following config:
> >
> > (public ip)
> > eth0
> > Firewall
> > eth1 (150.50.53.4)
> >
> > 148.145.133.1 (vpn router)
> >
> > 150.50.57.0/24
> > (LAN, including a server with 150.50.57.2)
> >
> > *Class 150.50.57.0/24 is routed to 148.245.164.1
> >
> > I want that when people(from eth1 lan) goes to 150.50.53.5, be
> > redirected to 150.50.57.2.
> >
> > I tried:
> >
> > iptables -t nat -A PREROUTING 150.50.53.5 -j DNAT --to-destination
> > 150.50.57.2
> >
> > But doesn't seem to be working. Any idea if it is possible and how to do
> > it?
>
> That looks correct.   Do you have a suitable FORWARD rule to allow the
> translated packets through the firewall?
>
> Does 150.50.57.2 know how to route the replies back again (through the
> firewall)?
>
> How are you testing?
>
> I'm not sure I understand the significance of the "VPN router" shown on
your
> diagram with only a single IP address - can you explain further what this
> means, and what is its relevance to the setup?
>
> Regards,
>
> Antony.
>
> -- 
> Never write it in Perl if you can do it in Awk.
> Never do it in Awk if sed can handle it.
> Never use sed when tr can do the job.
> Never invoke tr when cat is sufficient.
> Avoid using cat whenever possible.
>
>                                                      Please reply to the
list;
>                                                            please don't CC
me.
>
>