Masquerade (Newbie)

Masquerade (Newbie)

[Richard A Downing]

I have followed the NAT-HOWTO to set up iptables1-2.6a with kernel 2.4.18,
using modules.

The iptables_nat module loads fine, but 

iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE

gives: iptables: No chain/target/match by that name

I've checked that the 'libipt_MASQUERADE.so' file is in /usr/lib/iptables.  If I command:
iptables -t nat -A POSTROUTING -o ppp0 -j SNAT --to 62.255.122.217
then this happens:

iptables -t nat --list
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
SNAT       all  --  anywhere             anywhere           to:192.168.1.0

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

So now I'm stumped!

What I am attempting to do is to rpovide my other two machines on my
local LAN (192.168.1....) with internet access via 192.168.1.3 using ppp.
If I get this to the point where it works then it will be worth mu while buying
into broadband.

Sorry to be so stupid, all suggestions welcomed.

Richard

Re: Masquerade (Newbie)

[Antony Stone]

On Sunday 09 June 2002 4:47 pm, Richard A Downing wrote:

> If I command: iptables -t nat -A POSTROUTING -o ppp0 -j SNAT --to
> 62.255.122.217 then this happens:
>
> iptables -t nat --list
> Chain POSTROUTING (policy ACCEPT)
> target     prot opt source               destination
> SNAT       all  --  anywhere             anywhere           to:192.168.1.0

What is the local address of ppp0 at the time you did this ?


Antony.

Re: Masquerade (Newbie)

[Antony Stone]

On Sunday 09 June 2002 5:04 pm, Richard A Downing wrote:

> > > If I command: iptables -t nat -A POSTROUTING -o ppp0 -j
> > > SNAT --to 62.255.122.217 then this happens:
> > >
> > > iptables -t nat --list
> > > Chain POSTROUTING (policy ACCEPT)
> > > target     prot opt source               destination
> > > SNAT       all  --  anywhere             anywhere
> > >   to:192.168.1.0
> >
> > What is the local address of ppp0 at the time you did this  ?

> A route -n gave:
>
> Kernel IP routing table
> Destination     Gateway         Genmask         Flags Iface
> 62.255.122.217  0.0.0.0         255.255.255.255 UH  ppp0
> 192.168.1.0     0.0.0.0           255.255.255.0     U    eth0
> 0.0.0.0         62.255.122.217  0.0.0.0              UG   ppp0

(Excuse my reformatting of that to avoid line breaks)

It looks to me like 62.255.122.217 is the address at the remote end of your 
ppp link, not the local end.

What does the output of ifconfig ppp0 tell you ?

I think you're trying to tell netfilter to SNAT to an address which is not on 
the interface.   I don't know what it's supposed to do if you try this.

By the way, is ppp0 a serial interface (eg modem), or is it associated with 
eth0 somehow ?   I wonder why netfilter used the address of eth0 to 
masquerade behind....


Antony.

Re: Masquerade (Newbie)

[Antony Stone]

On Sunday 09 June 2002 9:18 pm, Richard A Downing wrote:

> ifconfig ppp0
> ppp0      Link encap:Point-to-Point Protocol
>           inet addr:213.104.157.9  P-t-P:62.255.122.225 
>
> root:/usr/lib/iptables$: iptables -t nat -F
> root:/usr/lib/iptables$: iptables -t nat -A POSTROUTING -o ppp0 -j
> MASQUERADE
> iptables: No chain/target/match by that name

Okay.   I still do not know why you cannot use the MASQUERADE target, but I 
do not use modules - I have everything compiled-in to the kernel, so I don't 
know what you need to look for to find out why that command isn't working.   
Hopefully someone else can help on that one ?

However, the ppp0 info you posted tells me that your local address is 
213.104.157.9, so this is the address you should be using in your SNAT rule 
as a workaround.

The 62.255.122.225 address is the other end of the link, which your machine 
is routing to, therefore you shouldn't be trying to masquerade your outgoing 
packets on this address.
 
 
 
Antony.

Re: Masquerade (Newbie)

[Richard A Downing]

Antony,

I was helped by email from another list member.  The error below goes away if 
the kernel modules are compiled in (I.E. NOT modules).  Perhaps there is a 
kernel bug here.

I am pleased to say that I now have Masquerade running fine, and my LAN 
machines happily soaking my bandwidth ;-)

Thanks for your help,
Richard.


On Sunday 09 June 2002 22:26, Antony Stone wrote:
On Sunday 09 June 2002 9:18 pm, Richard A Downing wrote:

> root:/usr/lib/iptables$: iptables -t nat -A POSTROUTING -o ppp0 -j
> MASQUERADE
> iptables: No chain/target/match by that name

Okay.   I still do not know why you cannot use the MASQUERADE target, but I
do not use modules - I have everything compiled-in to the kernel, so I don't
know what you need to look for to find out why that command isn't working.
Hopefully someone else can help on that one ?

Re: Masquerade (Newbie)

[Francois Chenais]

Have you 

    modprobe iptable_nat

	François



On Mon, 10 Jun 2002 17:44:57 +0100
Richard A Downing <richard.downing@bcs.org.uk> wrote:

  | Antony,
  | 
  | I was helped by email from another list member.  The error below goes away if 
  | the kernel modules are compiled in (I.E. NOT modules).  Perhaps there is a 
  | kernel bug here.
  | 
  | I am pleased to say that I now have Masquerade running fine, and my LAN 
  | machines happily soaking my bandwidth ;-)
  | 
  | Thanks for your help,
  | Richard.
  | 
  | 
  | On Sunday 09 June 2002 22:26, Antony Stone wrote:
  | On Sunday 09 June 2002 9:18 pm, Richard A Downing wrote:
  | 
  | > root:/usr/lib/iptables$: iptables -t nat -A POSTROUTING -o ppp0 -j
  | > MASQUERADE
  | > iptables: No chain/target/match by that name
  | 
  | Okay.   I still do not know why you cannot use the MASQUERADE target, but I
  | do not use modules - I have everything compiled-in to the kernel, so I don't
  | know what you need to look for to find out why that command isn't working.
  | Hopefully someone else can help on that one ?
  | 
  | 
  |