Re: another iptables question

[Joel Newkirk <netfilter@newkirk.us>]

On Wednesday 27 November 2002 01:41 pm, james.Q.L wrote:
> still reading the HOWTO.
>
> in the howto, it discusses about how internal machine access
> webserver that is port forwarded to the same network. here
>
> $INET_IP as the internet_IP
>
> 1.packet leaves $LAN_BOX to $INET_IP.

I assume here that you use $LAN_BOX to mean any client machine on the LAN, and 
$INET_IP to mean the external IP of the gateway/firewall, IE the public IP 
that identifies it on the internet itself.  (and is also the 'official' IP of 
any servers hidden behind it on local private IPs)

> 2.the packet reaches the firewall.
> #my quesion: is the packet here looks like come from $INET_IP
> the firewall machine (i.e SNAT'ed when it goes out to request
> the webserver)?

If $LAN_BOX sends a packet to an IP that is on the internet, the procedure is 
to SNAT it at the firewall/gateway, so that once it leaves the gateway and 
passes out to the internet it appears to have come FROM the gateway's 
external IP, since that is the only address that a return packet from the 
internet can be routed to on the internet.

> 3.the packet gets DNAT'ed,and all other requierd action are
> taken,however,the packet is not SNAT'ed. so the same source IP
> address is used on the packet.

If the target of a packet is local (even if this is unknown to $LAN_BOX) then 
the packet needs to be DNATted, since it comes in addressed to $INET_IP, but 
once there we know it REALLY needs to go somewhere else.  If the packet came 
from the internet, then the return packet will normally go back to the 
gateway/firewall machine anyway, (always assuming the server is configured 
properly :^) which will then 'undo' the DNAT and send the packet on its way 
with $INET_IP as it's source IP, instead of the actual address of the server, 
which is private.

> # my question: what does it have to do with SNAT here? shouldn't
> it see the source come from $INET_IP ?

This is where it gets more complicated.  If $LAN_BOX sends a packet to 
$INET_IP that gets DNATted and forwarded to the local server, the reply from 
that server will go DIRECTLY to $LAN_BOX since it recongnizes the client as 
an IP that is local to it, therefore not requiring routing through the 
gateway.  The solution to this is to SNAT the DNAT.  What you do is DNAT the 
packet as it enters the firewall so that it will be forwarded to the server 
that handles it, even though it came in addressed to the firewall/gateway at 
$INET_IP.  THEN you SNAT that same packet as it leaves the firewall, so that 
the reply from the server will come BACK to the gateway/firewall.  On the 
return trip the SNAT is reversed (so that the packet gets forwarded back to 
the original requesting client) and then the DNAT is reversed (so that the 
client sees it as returning from $INET_IP instead of the 'private' IP of the 
actual server)

> then later the author has the solution like this:
> iptables -t nat -A POSTROUTING -p tcp --dst $HTTP_IP --dport 80
> -j SNAT  --to-source $LAN_IP
>
> my quesion: the source change to $LAN_IP during SNAT. it seems
> to me that when the webserver replies the request, it will reply
> to the $LAN_IP. how does it  go back to the firewall machine so
> it can be alterd?

For this to work, $LAN_IP is the IP on the LAN for the firewall/gateway, as 
opposed to $INET_IP being the IP on the internet for the firewall/gateway.  
It's NOT the IP of $LAN_BOX.  This is the SNAT mentioned above that ensures 
that the reply DOES go back to the firewall machine.

> sorry that is a lot questions. sincerely thanks for your help.

Not really, just three parts of the same overall question.  :^)  I hope I've 
helped, and you are certainly welcome.

j