DNAT to a virtual IP problems

DNAT to a virtual IP problems

[Stephen Mathezer]

I am having some trouble with DNAT. For various reasons I am running a
webserver that is listening on virtual IP addresses on the internal
interface of my firewall.  I am trying to forward ports 80 and 443 from
the external interface to various virtual internals.  No matter what I
do, packets never seem to show up on the virtual interfaces.

Relevant facts:

Kernel 2.4.17, iptables 1.2.6a (I could upgrade if I knew it would fix
                                my problems)
Cable internet connection (ie: DHCP) on the external interface
eth0 is external
eth1 is internal (192.168.8.1/24)

I have tried using an address on the same subnet (192.168.8.22) as well
as addresses on other subnets (192.168.3.22) for interfaces eth1:0,
eth1:1 etc.  NAT'ing to another box on the internal LAN works fine, it
is just NAT to the virtual that is broken.

I am doing the DNAT as follows:

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to
192.168.8.22:443

Tcpdump on eth0 shows traffic arriving, iptables doesn't log anything
interesting, although I guess I don't have any logging configured in the
nat table.  Tcpdump on eth1:0 never sees any packets arriving.

I am permitting port 443 connections inbound on eth0. An identical
configuration, except NAT'ing to another webserver on the LAN works
fine, it is just NAT'ing to a virtual that doesn't work.

I have also tried doing the source NAT just in case, although since
traffic never gets to eth1:0 it shouldn't matter at this point:

iptables -t nat -A POSTROUTING -d 192.168.8.22 --dport 443 -j SNAT --from 192.168.8.1

Should this work? Is there something else that I need to be doing?

thanks for any tips

-Steve

Re: DNAT to a virtual IP problems

[Joel Newkirk]

On Tuesday 18 February 2003 03:03 pm, Stephen Mathezer wrote:
> I am having some trouble with DNAT. For various reasons I am running a
> webserver that is listening on virtual IP addresses on the internal
> interface of my firewall.  I am trying to forward ports 80 and 443
> from the external interface to various virtual internals.  No matter
> what I do, packets never seem to show up on the virtual interfaces.

> eth0 is external
> eth1 is internal (192.168.8.1/24)
>
> I have tried using an address on the same subnet (192.168.8.22) as
> well as addresses on other subnets (192.168.3.22) for interfaces
> eth1:0, eth1:1 etc.  NAT'ing to another box on the internal LAN works
> fine, it is just NAT to the virtual that is broken.
>
> I am doing the DNAT as follows:
>
> iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to
> 192.168.8.22:443

> Tcpdump on eth0 shows traffic arriving, iptables doesn't log anything
> interesting, although I guess I don't have any logging configured in
> the nat table.  Tcpdump on eth1:0 never sees any packets arriving.

Try setting up a LOG rule first in each chain in filter and nat tables, 
and in mangle table if you have it loaded.  (just for a few packets, not 
too long)  What about tcpdump for eth1?

> I am permitting port 443 connections inbound on eth0. An identical
> configuration, except NAT'ing to another webserver on the LAN works
> fine, it is just NAT'ing to a virtual that doesn't work.

Hmmm.  You say you are accepting tcp 443 on eth0.  What about eth1?  That 
is the physical interface the packets should appear 'from' when they hit 
INPUT chain. 

j

Re: DNAT to a virtual IP problems

[Tiziano Müller]

Hi steve

I\'ve the same problem, but I didn\'t find a solution.
All what I can say is that I\'m using iptables 1.2.7a
and kernel 2.4.20 and the problem remains.

greetz
tiziano