Linux Netfilter discussions
 help / color / mirror / Atom feed
* RE: to snat or to dnat .. that is the question
@ 2004-06-01 14:42 Piszcz, Justin Michael
  2004-06-01 14:51 ` Peter Marshall
  0 siblings, 1 reply; 10+ messages in thread
From: Piszcz, Justin Michael @ 2004-06-01 14:42 UTC (permalink / raw)
  To: Peter Marshall, netfilter

If the box 192.168.0.20 does not have the firewall's IP as its default
route, then it will not work correctly (DNAT), I am not sure about SNAT.


-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Peter Marshall
Sent: Tuesday, June 01, 2004 10:30 AM
To: netfilter
Subject: to snat or to dnat .. that is the question

Hi again.

I am at a bit of a quandary, and am not sure what to do.

Let the external interface on my firewall be 100.100.100.100
I have an internal box; 192.168.0.20 that needs to connect to an
external
box 200.200.200.200 on port 2000.

I want the internal box to connect to hit my firewall on a different
port ..
say 15000

so basically

start: .... -s 192.168.0.20 -d 200.200.200.200 --dport 15000
after firewall -s 100.100.100.100 -d 200.200.200.200 --dport 2000

How can I do this ?

I started out with:

$IPT -t nat -A POSTROUTING -d 200.200.200.200 --dport 15000 -p tcp -i
eth0 \
       -j SNAT --to-source 100.100.100.100

But this does not change the destination port (obviously). I thought
about
doing the following

$IPT -t nat -A PREROUTING -d 100.100.100.100 --dport 15000 -p tcp -i
eth0 \
         -j DNAT --to-destination 200.200.200.200 --dport 2000

However, I don't think that this will change my source address.  Also,
will
this even forwarded the packets ?  They would be coming on the input
chain
would they not ?


Thank you for the help.
Peter Marshall


Peter Marshall, BCS
Network Administrator, CARIS
115 Waggoners Lane, Fredericton NB, E3B 2L4 CANADA
Phone:  (506) 458-8533 (Reception)






^ permalink raw reply	[flat|nested] 10+ messages in thread
* RE: to snat or to dnat .. that is the question
@ 2004-06-01 17:38 Daniel Chemko
  0 siblings, 0 replies; 10+ messages in thread
From: Daniel Chemko @ 2004-06-01 17:38 UTC (permalink / raw)
  To: Peter Marshall, Alistair Tonner, netfilter

Peter Marshall wrote:
> That's insane .. please tell me you did not just come up with that
> and that you are already using that .....
> Thank you for the reply. :)

Nope, just came up with it. I love bash!
There are definitly more efficient techniques, but I imagine that'd be
something good enough for your purposes.
If you think that's crazy, you should see my (terse,unmaintainable)
firewall scripts... They're totally spagetti. Ah, time for a rewrite!



^ permalink raw reply	[flat|nested] 10+ messages in thread
* RE: to snat or to dnat .. that is the question
@ 2004-06-01 17:12 Daniel Chemko
  2004-06-01 17:30 ` Peter Marshall
  2004-06-01 17:52 ` Alistair Tonner
  0 siblings, 2 replies; 10+ messages in thread
From: Daniel Chemko @ 2004-06-01 17:12 UTC (permalink / raw)
  To: Peter Marshall, Alistair Tonner, netfilter

#!/bin/bash

IPT=/sbin/iptables
HST_L_INET="100.100.100.100"
HST_L_INTERNAL="192.168.0.1"
IP_DST_LIST="1.1.1.1 2.2.2.2 3.3.3.3 4.4.4.4"
PORT_LIS_LIST="15000 15001 15002 15003"
PORT_DST_LIST="2000 2001 2002 2003"

# This is just a demo. I'm sure bash arrays are cleaner...
_count=1
while [ ${_count} -lt 100 ]; 
do
   _dip="`echo ${IP_DST_LIST} | awk "{print \$${_count}}"`"
   _lpt="`echo ${PORT_LIS_LIST} | awk "{print \$${_count}}"`"
   _dpt="`echo ${PORT_DST_LIST} | awk "{print \$${_count}}"`"
   if [ ! -z "${_dip}"  -a ! -z "${_lpt}" -a -z "${_dpt}" ]; then
      $IPT -t nat -A PREROUTING -d ${HST_L_INTERNAL} -p tcp --dport
${_lpt} -j DNAT --to ${_dip}:${_dpt}
      $IPT -t nat -A POSTROUTING -d ${_dip} -p tcp --dport ${_dpt} -j
SNAT --to-source ${HST_L_INET}
   else
      break
   fi
   _count="$((${_count+1))"
done

Peter Marshall wrote:
> So ... for every nat I have going from my internal network on a
> specific port, destined to an external IP on a different port I need
> to have something like this ?
> 
>   $IPT -t nat -A PREROUTING -d <firewall_ip> --dport 15000 -p tcp -i
>        eth0 \ -j DNAT --to-destination <some_internet_ip> --dport 2000
> 
>   $IPT -t nat -A POSTROUTING -d <some_internet_ip> --dport 2000  -p
> tcp -o eth0 \
>        -j SNAT --to-source <firewall_ip>
> 
> Is there a better way ???  I have about 20 routes to add .....
> 
> Thank you for your help.
> 
> Peter
> 
> 
> ----- Original Message -----
> From: "Alistair Tonner" <Alistair@nerdnet.ca>
> To: <netfilter@lists.netfilter.org>
> Sent: Tuesday, June 01, 2004 12:16 PM
> Subject: Re: to snat or to dnat .. that is the question
> 
> 
> On June 1, 2004 10:51 am, Peter Marshall wrote:
>> yes, my firewall is the default route on all internal boxes
>> 
>> ----- Original Message -----
>> From: "Piszcz, Justin Michael" <justin.piszcz@mitretek.org>
>> To: "Peter Marshall" <peter.marshall@caris.com>; "netfilter"
>> <netfilter@lists.netfilter.org>
>> Sent: Tuesday, June 01, 2004 11:42 AM
>> Subject: RE: to snat or to dnat .. that is the question
>> 
>> 
>> If the box 192.168.0.20 does not have the firewall's IP as its
>> default route, then it will not work correctly (DNAT), I am not sure
>> about SNAT. 
>> 
>> 
>> -----Original Message-----
>> From: netfilter-admin@lists.netfilter.org
>> [mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Peter
>> Marshall Sent: Tuesday, June 01, 2004 10:30 AM
>> To: netfilter
>> Subject: to snat or to dnat .. that is the question
>> 
>> Hi again.
>> 
>> I am at a bit of a quandary, and am not sure what to do.
>> 
>> Let the external interface on my firewall be 100.100.100.100
>> I have an internal box; 192.168.0.20 that needs to connect to an
>> external box 200.200.200.200 on port 2000.
>> 
>> I want the internal box to connect to hit my firewall on a different
>> port .. say 15000
>> 
>> so basically
>> 
>> start: .... -s 192.168.0.20 -d 200.200.200.200 --dport 15000
>> after firewall -s 100.100.100.100 -d 200.200.200.200 --dport 2000
>> 
>> How can I do this ?
>> 
>> I started out with:
>> 
>> $IPT -t nat -A POSTROUTING -d 200.200.200.200 --dport 15000 -p tcp
>>        -i eth0 \ -j SNAT --to-source 100.100.100.100
>> 
>> But this does not change the destination port (obviously). I thought
>> about doing the following
>> 
>> $IPT -t nat -A PREROUTING -d 100.100.100.100 --dport 15000 -p tcp -i
>>          eth0 \ -j DNAT --to-destination 200.200.200.200 --dport 2000
> 
>> However, I don't think that this will change my source address. 
>> Also, will this even forwarded the packets ?  They would be coming
>> on the input chain would they not ?
> 
> Since you've done this in PREROUTING no, they wont hit the INPUT
> chain. This is where to start.
>> 
>> 
> 
> You need then to have a FORWARD rule to allow the packets, and
> ESTABLISHED,RELATED, and then in POSTROUTING add a rule to SNAT those
> packets
> destined to 200.200.200.200:2000 ( you could, if need be, add the
> source to the rule as well)
>> Thank you for the help.
>> Peter Marshall
>> 
>> 
>> Peter Marshall, BCS
>> Network Administrator, CARIS
>> 115 Waggoners Lane, Fredericton NB, E3B 2L4 CANADA
> 
> 
> Alistair Tonner
> -- from slightly west of there, on the last lake
> T.O.


^ permalink raw reply	[flat|nested] 10+ messages in thread
* to snat or to dnat .. that is the question
@ 2004-06-01 14:30 Peter Marshall
  0 siblings, 0 replies; 10+ messages in thread
From: Peter Marshall @ 2004-06-01 14:30 UTC (permalink / raw)
  To: netfilter

Hi again.

I am at a bit of a quandary, and am not sure what to do.

Let the external interface on my firewall be 100.100.100.100
I have an internal box; 192.168.0.20 that needs to connect to an external
box 200.200.200.200 on port 2000.

I want the internal box to connect to hit my firewall on a different port ..
say 15000

so basically

start: .... -s 192.168.0.20 -d 200.200.200.200 --dport 15000
after firewall -s 100.100.100.100 -d 200.200.200.200 --dport 2000

How can I do this ?

I started out with:

$IPT -t nat -A POSTROUTING -d 200.200.200.200 --dport 15000 -p tcp -i eth0 \
       -j SNAT --to-source 100.100.100.100

But this does not change the destination port (obviously). I thought about
doing the following

$IPT -t nat -A PREROUTING -d 100.100.100.100 --dport 15000 -p tcp -i eth0 \
         -j DNAT --to-destination 200.200.200.200 --dport 2000

However, I don't think that this will change my source address.  Also, will
this even forwarded the packets ?  They would be coming on the input chain
would they not ?


Thank you for the help.
Peter Marshall


Peter Marshall, BCS
Network Administrator, CARIS
115 Waggoners Lane, Fredericton NB, E3B 2L4 CANADA
Phone:  (506) 458-8533 (Reception)



^ permalink raw reply	[flat|nested] 10+ messages in thread
end of thread, other threads:[~2004-06-01 17:52 UTC | newest]

Thread overview: 10+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2004-06-01 14:42 to snat or to dnat .. that is the question Piszcz, Justin Michael
2004-06-01 14:51 ` Peter Marshall
2004-06-01 15:16   ` Alistair Tonner
2004-06-01 16:27     ` Peter Marshall
2004-06-01 17:50       ` Alistair Tonner
  -- strict thread matches above, loose matches on Subject: below --
2004-06-01 17:38 Daniel Chemko
2004-06-01 17:12 Daniel Chemko
2004-06-01 17:30 ` Peter Marshall
2004-06-01 17:52 ` Alistair Tonner
2004-06-01 14:30 Peter Marshall

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox