Re: DNAT to a virtual IP problems

[Joel Newkirk <netfilter@newkirk.us>]

On Tuesday 18 February 2003 03:03 pm, Stephen Mathezer wrote:
> I am having some trouble with DNAT. For various reasons I am running a
> webserver that is listening on virtual IP addresses on the internal
> interface of my firewall.  I am trying to forward ports 80 and 443
> from the external interface to various virtual internals.  No matter
> what I do, packets never seem to show up on the virtual interfaces.

> eth0 is external
> eth1 is internal (192.168.8.1/24)
>
> I have tried using an address on the same subnet (192.168.8.22) as
> well as addresses on other subnets (192.168.3.22) for interfaces
> eth1:0, eth1:1 etc.  NAT'ing to another box on the internal LAN works
> fine, it is just NAT to the virtual that is broken.
>
> I am doing the DNAT as follows:
>
> iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to
> 192.168.8.22:443

> Tcpdump on eth0 shows traffic arriving, iptables doesn't log anything
> interesting, although I guess I don't have any logging configured in
> the nat table.  Tcpdump on eth1:0 never sees any packets arriving.

Try setting up a LOG rule first in each chain in filter and nat tables, 
and in mangle table if you have it loaded.  (just for a few packets, not 
too long)  What about tcpdump for eth1?

> I am permitting port 443 connections inbound on eth0. An identical
> configuration, except NAT'ing to another webserver on the LAN works
> fine, it is just NAT'ing to a virtual that doesn't work.

Hmmm.  You say you are accepting tcp 443 on eth0.  What about eth1?  That 
is the physical interface the packets should appear 'from' when they hit 
INPUT chain. 

j