Linux routing scenario - is this possible?

Linux routing scenario - is this possible?

[Miguel Manso]

Hi there,

I'm having a problem with linux routing and maybe
someone on the list could help me out or point me to
the right direction.

I've subscribed an DSL line (1024 kbit) that included
2 static IPs (123.123.123.100 and 123.123.123.101).

My goal is to share the line with two companies that
will have two totaly separed networks.

I've a linux machine with 3 eth's with the following
configuration:

eth0   -> 123.123.123.100  Company 1 static IP
eth0:1 -> 196.168.1.254    Company 1 gateway

eth1   -> 196.168.0.5      DSL line is connected here

eth2   -> 123.123.123.101  Company 2 static IP
eth2:1 -> 196.168.2.254    Company 2 gateway

The gateway of the router is 192.168.0.1 (DSL modem
IP).

The main idea here is having two companies on two
different networks: 192.168.1 and 192.168.2.

What I'd like to achive is:

- external connections to 123.123.123.100 should go to
the eth0 and external connections to 123.123.123.101
should go to the eth2;
- people from 192.168.1 network should connect the
outside world with IP 123.123.123.100 and people from
the 192.168.2 network should use the 123.123.123.101
IP.

Ok, this is my main goal. Am I wrong in any concept?
Is this possible?

If someone could point me to the right direction, I
would appreciate it.

Thanks a lot...


=====
Miguel Manso
mmanso@yahoo.com

__________________________________________________
Do you Yahoo!?
Yahoo! Web Hosting - establish your business online
http://webhosting.yahoo.com

Re: Linux routing scenario - is this possible?

[Joel Newkirk]

On Sunday 16 March 2003 04:25 pm, Miguel Manso wrote:
> Hi there,
>
> I'm having a problem with linux routing and maybe
> someone on the list could help me out or point me to
> the right direction.
>
> I've subscribed an DSL line (1024 kbit) that included
> 2 static IPs (123.123.123.100 and 123.123.123.101).
>
> My goal is to share the line with two companies that
> will have two totaly separed networks.
>
> I've a linux machine with 3 eth's with the following
> configuration:
>
> eth0   -> 123.123.123.100  Company 1 static IP
> eth0:1 -> 196.168.1.254    Company 1 gateway
>
> eth1   -> 196.168.0.5      DSL line is connected here
>
> eth2   -> 123.123.123.101  Company 2 static IP
> eth2:1 -> 196.168.2.254    Company 2 gateway
>
> The gateway of the router is 192.168.0.1 (DSL modem
> IP).
>
> The main idea here is having two companies on two
> different networks: 192.168.1 and 192.168.2.
>
> What I'd like to achive is:
>
> - external connections to 123.123.123.100 should go to
> the eth0 and external connections to 123.123.123.101
> should go to the eth2;
> - people from 192.168.1 network should connect the
> outside world with IP 123.123.123.100 and people from
> the 192.168.2 network should use the 123.123.123.101
> IP.
>
> Ok, this is my main goal. Am I wrong in any concept?
> Is this possible?

If your routing is already set up properly, then all that should be 
necessary is to have both IPs on the external interface, and DNAT.

iptables -t nat -A PREROUTING -i eth1 -d 123.123.123.100 -j   \
DNAT --to a.b.c.d
iptables -t nat -A PREROUTING -i eth1 -d 123.123.123.101 -j   \
DNAT --to e.f.g.h

where a.b.c.d is the IP within one company's network to which you want to 
forward incoming connections, and e.f.g.h is for the other company.  You 
can further refine this by having separate DNAT rules for different 
protocols if needed, to send HTTP to a web server, SMTP/POP3/IMAP to a 
mail server, etc.

Interface eth1 (ppp0, whatever) should have two IPs, the public IP's of 
each of the companies.  eth0 should have a private IP that is in the 
private IP block used by the company on eth0, and be reachable by all 
clients in that network.  The same applies to eth2.  The only thing to 
be careful of is that the two companies use distinct subnets.  You don't 
want one using 192.168.0.0/20 and the other 192.168.1.0/24, for example, 
since the latter is contained in the former.  This would cause a 
connection sent to 192.168.1.1, for example, to be ambiguous. (it could 
mean either company)

I notice you use 192.168.0.5 for the DSL connection.  Is that accurate?  
If so, you may already have NAT taking place upstream, either in a 
cable/dsl router, or at your gateway at the ISP, and you need to ensure 
that the packets reaching you still have those public IP's as their 
destination.  Make sure your box is reachable at each of the public IPs.  
If so, then two PREROUTING rules, one for each publicIP/Company are the 
minimum needed to make this work.

Also, be aware that if you redirect all incoming 123.123.123.100 to one 
company, and all 123.123.123.101 to the other, that leaves nothing 
incoming to you.  If you have any need for NEW connections initiated on 
the internet to reach your own machine/network, then you either need a 
third public IP, or you'll need to work a lot harder with the DNAT to 
separate traffic to custom ports or some such that willl be considered 
addressed to you instead of the company whose IP you piggyback on.

j

Re: Linux routing scenario - is this possible?

[Miguel Manso]

Hi there,

First of all, thanks for the answer.

--- Joel Newkirk <netfilter@newkirk.us> wrote:
> If your routing is already set up properly, then all that should be 
> necessary is to have both IPs on the external interface, and DNAT.
>
> iptables -t nat -A PREROUTING -i eth1 -d 123.123.123.100 -j   \
> DNAT --to a.b.c.d
> iptables -t nat -A PREROUTING -i eth1 -d 123.123.123.101 -j   \
> DNAT --to e.f.g.h
> 
> where a.b.c.d is the IP within one company's network to which you want to 
> forward incoming connections, and e.f.g.h is for the other company.  You 
> can further refine this by having separate DNAT rules for different 
> protocols if needed, to send HTTP to a web server, SMTP/POP3/IMAP to a 
> mail server, etc.

Supposing I've the routing well configured, this seams ok for incomming
traffic. Read below for some doubts I've about traffic leaving both companies
networks.

> Interface eth1 (ppp0, whatever) should have two IPs, the public IP's of 
> each of the companies.  eth0 should have a private IP that is in the 
> private IP block used by the company on eth0, and be reachable by all 
> clients in that network.  The same applies to eth2.

The private IP I must assign to eth0 and eth2 (I was thinking about
192.168.1.254 and 192.168.2.254) will be used like gateways in both comapnies,
no? If so, how do I say on the linux machine (router) that connections from
192.168.1.254 should leave with IP 123.123.123.100 and connections from
192.168.2.254 with IP 123.123.123.101?

Don't know if I'm expressing myself correctly.

> The only thing to be careful of is that the two companies use distinct
> subnets.  You don't 
> want one using 192.168.0.0/20 and the other 192.168.1.0/24, for example, 
> since the latter is contained in the former.  This would cause a 
> connection sent to 192.168.1.1, for example, to be ambiguous. (it could 
> mean either company)

I was thinking about 192.168.1.0/24 for one and 192.168.2.0/24 for the other.

> I notice you use 192.168.0.5 for the DSL connection.  Is that accurate?  
> If so, you may already have NAT taking place upstream, either in a 
> cable/dsl router, or at your gateway at the ISP, and you need to ensure 
> that the packets reaching you still have those public IP's as their 
> destination.  Make sure your box is reachable at each of the public IPs.  
> If so, then two PREROUTING rules, one for each publicIP/Company are the 
> minimum needed to make this work.

Well, the modem IP is 192.168.0.1 (can be configured on the modem via a http
interface) and I've just assigned on the linux box (acting as a router) the
192.168.0.5 IP to the ethernet where I connect the modem to. On this machine
I've defined the modem IP 192.168.0.1 as being the gateway.

> Also, be aware that if you redirect all incoming 123.123.123.100 to one 
> company, and all 123.123.123.101 to the other, that leaves nothing 
> incoming to you.  If you have any need for NEW connections initiated on 
> the internet to reach your own machine/network, then you either need a 
> third public IP, or you'll need to work a lot harder with the DNAT to 
> separate traffic to custom ports or some such that willl be considered 
> addressed to you instead of the company whose IP you piggyback on.
 
Yes, but that's not a problem since one of the companies is my own. We've one
1024 kbits DSL line and we're trying to "split" the costs between our and other
companies.

Any information about the subject will be appreciated. I'm a newbie on the
subject needing some direction points.

Thanks again.



=====
Miguel Manso
mmanso@yahoo.com

__________________________________________________
Do you Yahoo!?
Yahoo! Web Hosting - establish your business online
http://webhosting.yahoo.com

Re: Linux routing scenario - is this possible?

[Joel Newkirk]

On Sunday 16 March 2003 07:29 pm, Miguel Manso wrote:
> Hi there,
>
> First of all, thanks for the answer.

:^)

> The private IP I must assign to eth0 and eth2 (I was thinking about
> 192.168.1.254 and 192.168.2.254) will be used like gateways in both
> comapnies, no? If so, how do I say on the linux machine (router) that
> connections from 192.168.1.254 should leave with IP 123.123.123.100
> and connections from 192.168.2.254 with IP 123.123.123.101?

iptables -t nat -A POSTROUTING -o eth1 -s 192.168.1.0/24  \
-j SNAT --to 123.123.123.100
iptables -t nat -A POSTROUTING -o eth1 -s 192.168.2.0/24  \
-j SNAT --to 123.123.123.101

OR

iptables -t nat -A POSTROUTING -i eth0 -j SNAT --to 123.123.123.100
iptables -t nat -A POSTROUTING -i eth2 -j SNAT --to 123.123.123.101

> Don't know if I'm expressing myself correctly.

You seem clear to me. 

Your first priority needs to be determining if you can use the two IPs 
and distinguish between them on your box.  If the NAT from local IPs to 
public and back is all handled by the modem then netfilter on a machine 
connected to that modem probably can't do a thing.  If this is what is 
happening, you need to see if you can reconfigure the modem to pass 
things through unchanged.

I'm not sure what your DSL setup is like.  For me, I use a Westell White 
modem, and even though it connects via ethernet to my gateway, it works 
like a 'normal' modem, where the gateway itself has the IPs via PPPoE, 
not the modem.  The modem itself is transparent - for all intents and 
purposes my gateway connects 'directly' to the upstream gateway at my 
ISP. 


> Well, the modem IP is 192.168.0.1 (can be configured on the modem via
> a http interface) and I've just assigned on the linux box (acting as a
> router) the 192.168.0.5 IP to the ethernet where I connect the modem
> to. On this machine I've defined the modem IP 192.168.0.1 as being the
> gateway.

OK, but when the incoming traffic reaches your netfilter box, what is its 
destination IP?  If it no longer has the 123.123.123.100 and 
123.123.123.101 IPs at that point, then you can't DNAT on the iptables 
box.  (well, of course you CAN, but telling the two streams of traffic 
apart is the problem)  If you don't know, try setting a LOG rule:

iptables -t nat -I PREROUTING 1 -i eth1 -p icmp -j LOG --log-prefix 
"ICMP:"

for instance.  With this rule in place, have someone at a machine outside 
your network ping your public IPs through the internet, and see what the 
log shows for DestinationIP of the incoming Pings.  After they try the 
ping (even if it doesn't get through) try "cat /var/log/messages | grep 
ICMP".  (BTW, the "-I ... 1" means insert as rule #1 in the chain)

> > Also, be aware that if you redirect all incoming 123.123.123.100 to
> > one company, and all 123.123.123.101 to the other, that leaves
> > nothing incoming to you.  

> Yes, but that's not a problem since one of the companies is my own.
> We've one 1024 kbits DSL line and we're trying to "split" the costs
> between our and other companies.

OK.

> Any information about the subject will be appreciated. I'm a newbie on
> the subject needing some direction points.

First resource oughtta be http://iptables-tutorial.frozentux.net

j

Re: Linux routing scenario - is this possible?

[Miguel Manso]

Hi there,

It's all working now... the problem was that the modem was doing PPPoE auth
and, because that, doing some kind of NAT.

I've changed it to work in "Bridging" mode, used pppoe autentication on the
linux box and all the iptables rules started working like a charm.

Thanks for all the help. The rules you've told me were a great help.



--- Joel Newkirk <netfilter@newkirk.us> wrote:
> On Sunday 16 March 2003 07:29 pm, Miguel Manso wrote:
> > Hi there,
> >
> > First of all, thanks for the answer.
> 
> :^)
> 
> > The private IP I must assign to eth0 and eth2 (I was thinking about
> > 192.168.1.254 and 192.168.2.254) will be used like gateways in both
> > comapnies, no? If so, how do I say on the linux machine (router) that
> > connections from 192.168.1.254 should leave with IP 123.123.123.100
> > and connections from 192.168.2.254 with IP 123.123.123.101?
> 
> iptables -t nat -A POSTROUTING -o eth1 -s 192.168.1.0/24  \
> -j SNAT --to 123.123.123.100
> iptables -t nat -A POSTROUTING -o eth1 -s 192.168.2.0/24  \
> -j SNAT --to 123.123.123.101
> 
> OR
> 
> iptables -t nat -A POSTROUTING -i eth0 -j SNAT --to 123.123.123.100
> iptables -t nat -A POSTROUTING -i eth2 -j SNAT --to 123.123.123.101
> 
> > Don't know if I'm expressing myself correctly.
> 
> You seem clear to me. 
> 
> Your first priority needs to be determining if you can use the two IPs 
> and distinguish between them on your box.  If the NAT from local IPs to 
> public and back is all handled by the modem then netfilter on a machine 
> connected to that modem probably can't do a thing.  If this is what is 
> happening, you need to see if you can reconfigure the modem to pass 
> things through unchanged.
> 
> I'm not sure what your DSL setup is like.  For me, I use a Westell White 
> modem, and even though it connects via ethernet to my gateway, it works 
> like a 'normal' modem, where the gateway itself has the IPs via PPPoE, 
> not the modem.  The modem itself is transparent - for all intents and 
> purposes my gateway connects 'directly' to the upstream gateway at my 
> ISP. 
> 
> 
> > Well, the modem IP is 192.168.0.1 (can be configured on the modem via
> > a http interface) and I've just assigned on the linux box (acting as a
> > router) the 192.168.0.5 IP to the ethernet where I connect the modem
> > to. On this machine I've defined the modem IP 192.168.0.1 as being the
> > gateway.
> 
> OK, but when the incoming traffic reaches your netfilter box, what is its 
> destination IP?  If it no longer has the 123.123.123.100 and 
> 123.123.123.101 IPs at that point, then you can't DNAT on the iptables 
> box.  (well, of course you CAN, but telling the two streams of traffic 
> apart is the problem)  If you don't know, try setting a LOG rule:
> 
> iptables -t nat -I PREROUTING 1 -i eth1 -p icmp -j LOG --log-prefix 
> "ICMP:"
> 
> for instance.  With this rule in place, have someone at a machine outside 
> your network ping your public IPs through the internet, and see what the 
> log shows for DestinationIP of the incoming Pings.  After they try the 
> ping (even if it doesn't get through) try "cat /var/log/messages | grep 
> ICMP".  (BTW, the "-I ... 1" means insert as rule #1 in the chain)
> 
> > > Also, be aware that if you redirect all incoming 123.123.123.100 to
> > > one company, and all 123.123.123.101 to the other, that leaves
> > > nothing incoming to you.  
> 
> > Yes, but that's not a problem since one of the companies is my own.
> > We've one 1024 kbits DSL line and we're trying to "split" the costs
> > between our and other companies.
> 
> OK.
> 
> > Any information about the subject will be appreciated. I'm a newbie on
> > the subject needing some direction points.
> 
> First resource oughtta be http://iptables-tutorial.frozentux.net
> 
> j


=====
Miguel Manso
mmanso@yahoo.com

__________________________________________________
Do you Yahoo!?
Yahoo! Platinum - Watch CBS' NCAA March Madness, live on your desktop!
http://platinum.yahoo.com