From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Roberto Rossi" Subject: mail server problem Date: Mon, 10 Nov 2003 10:48:37 +0100 Sender: netfilter-admin@lists.netfilter.org Message-ID: <008a01c3a76f$d084fa10$0101010a@tv.smc> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0087_01C3A778.322DC3C0" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter@lists.netfilter.org This is a multi-part message in MIME format. ------=_NextPart_000_0087_01C3A778.322DC3C0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hello all, I've a range of 30 public internet addresses to manage starting, say, = from 213.25.24.0 to 213.25.24.31 netmask of course 255.255.255.224. My firewall (Red Hat 9.0, latest kernel) public IP is 213.25.24.30 the = router address is 213.25.24.1 and the LAN network is 10.1.0.0/16. I've an internal mail server, say, 10.1.1.2 which I would like to see = from the outside as 213.25.24.3, one IP of my range. Except DNS registration, what are the correct steps to make this = possible? I just set this rule on my firewall: iptables -t nat -A PREROUTING -p tcp -i eth0 -d 213.25.24.3 --dport 25 = -j DNAT --to 10.1.1.2:25 but I guess it's not enough because it's not working. A help is really appreciated, thanks in advance. Roberto - Italy ------=_NextPart_000_0087_01C3A778.322DC3C0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Hello all,

I've a range of 30 public internet = addresses to=20 manage starting, say, from 213.25.24.0 to 213.25.24.31 netmask of course = 255.255.255.224.

My firewall (Red Hat 9.0, latest=20 kernel) public IP is 213.25.24.30 the router address=20 is 213.25.24.1 and the LAN network is = 10.1.0.0/16.

I've an internal mail server, say, = 10.1.1.2 which=20 I would like to see from the outside as 213.25.24.3, one IP of my=20 range.

Except DNS registration, what are the = correct=20 steps to make this possible?

I just set this rule on my = firewall:

iptables -t nat -A PREROUTING -p tcp = -i eth0 -d=20 213.25.24.3 --dport 25 -j DNAT --to 10.1.1.2:25

but I guess it's not enough because = it's not=20 working.

A help is really appreciated, thanks = in=20 advance.

Roberto - Italy =20

------=_NextPart_000_0087_01C3A778.322DC3C0-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Antony Stone Subject: Re: mail server problem Date: Mon, 10 Nov 2003 09:58:53 +0000 Sender: netfilter-admin@lists.netfilter.org Message-ID: <200311100958.hAA9wwj16722@agate.rockstone.co.uk> References: <008a01c3a76f$d084fa10$0101010a@tv.smc> Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Return-path: In-Reply-To: <008a01c3a76f$d084fa10$0101010a@tv.smc> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.netfilter.org On Monday 10 November 2003 9:48 am, Roberto Rossi wrote: > Hello all, > > I've a range of 30 public internet addresses to manage starting, say, from > 213.25.24.0 to 213.25.24.31 netmask of course 255.255.255.224. > > My firewall (Red Hat 9.0, latest kernel) public IP is 213.25.24.30 the > router address is 213.25.24.1 and the LAN network is 10.1.0.0/16. > > I've an internal mail server, say, 10.1.1.2 which I would like to see from > the outside as 213.25.24.3, one IP of my range. > > Except DNS registration, what are the correct steps to make this possible? > > I just set this rule on my firewall: > iptables -t nat -A PREROUTING -p tcp -i eth0 -d 213.25.24.3 --dport 25 -j > DNAT --to 10.1.1.2:25 > > but I guess it's not enough because it's not working. You need two more things: 1. A FORWARDing rule to allow the traffic through: iptables -A FORWARD -p tcp --dport 25 -d 10.1.1.2 -j ACCEPT (note that this rule uses the true destination address, because the FORWARD chain comes after the PREROUTING chain, so the DNAT has already been done.) 2. An ARP response on the external interface so your router knows that 213.25.24.3 can be found there: old method: ifconfig eth0:1 213.25.24.3 new method: ip addr add dev eth0 213.25.24.3 Antony. -- What I don't know far exceeds what I know, but unfortunately, it is far easier to write about what I know than about what I don't know. - Kevin Kelly, Out of Control Please reply to the list; please don't CC me. From mboxrd@z Thu Jan 1 00:00:00 1970 From: netfilter@tommi.org Subject: Re: mail server problem Date: Mon, 10 Nov 2003 10:15:09 +0000 Sender: netfilter-admin@lists.netfilter.org Message-ID: <20031110101509.GA9937@ok.is> References: <008a01c3a76f$d084fa10$0101010a@tv.smc> <200311100958.hAA9wwj16722@agate.rockstone.co.uk> Mime-Version: 1.0 Return-path: Content-Disposition: inline In-Reply-To: <200311100958.hAA9wwj16722@agate.rockstone.co.uk> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: netfilter@lists.netfilter.org On Mon, Nov 10, 2003 at 09:58:53AM +0000, Antony Stone wrote: > > You need two more things: > > 1. A FORWARDing rule to allow the traffic through: > > iptables -A FORWARD -p tcp --dport 25 -d 10.1.1.2 -j ACCEPT > > (note that this rule uses the true destination address, because the FORWARD > chain comes after the PREROUTING chain, so the DNAT has already been done.) > > 2. An ARP response on the external interface so your router knows that > 213.25.24.3 can be found there: > > old method: > ifconfig eth0:1 213.25.24.3 > > new method: > ip addr add dev eth0 213.25.24.3 > If I have a network routed to my linux box say 192.168.1.0/24, do I still have to add every IP on the subnet if I want to be able to use NATing for the entire subnet? Also doesn't adding 250 IP addresses to a NIC affect performance? ==== Tomas Edwardsson > > Antony. From mboxrd@z Thu Jan 1 00:00:00 1970 From: Antony Stone Subject: Re: mail server problem Date: Mon, 10 Nov 2003 10:25:40 +0000 Sender: netfilter-admin@lists.netfilter.org Message-ID: <200311101025.hAAAPjj16744@agate.rockstone.co.uk> References: <008a01c3a76f$d084fa10$0101010a@tv.smc> <200311100958.hAA9wwj16722@agate.rockstone.co.uk> <20031110101509.GA9937@ok.is> Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Return-path: In-Reply-To: <20031110101509.GA9937@ok.is> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@lists.netfilter.org On Monday 10 November 2003 10:15 am, netfilter@tommi.org wrote: > > ip addr add dev eth0 213.25.24.3 > > If I have a network routed to my linux box say 192.168.1.0/24, do I still > have to add every IP on the subnet if I want to be able to use NATing for > the entire subnet? You need to add every IP address for which you want an interface to accept packets on a local subnet. Otherwise the upstream router won't know where to send them becaause nothing responds to ARP requests. > Also doesn't adding 250 IP addresses to a NIC affect performance? I'm inclined to say "no", however someone's bound to say "it affects it by some miniscule amount", so I'll say "it affects the performance of the box a lot less than does routing the traffic you want to push through it". If you don't like the idea of adding 250 addresses to an interface, simply change your network layout so that those addresses are being routed through the netfilter machine, rather than existing on a subnet it is directly connected to, then you can do the DNAT and the FORWARD without needing thr address attached to the interface. Antony. -- Most people have more than the average number of legs. Please reply to the list; please don't CC me. From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Roberto Rossi" Subject: mail server problem Date: Fri, 7 Nov 2003 16:10:01 +0100 Sender: netfilter-admin@lists.netfilter.org Message-ID: <005e01c3a541$375c29b0$0101010a@tv.smc> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_005B_01C3A549.98FBF2B0" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter@lists.netfilter.org This is a multi-part message in MIME format. ------=_NextPart_000_005B_01C3A549.98FBF2B0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hello all, I've a range of 30 public internet addresses to manage starting, say, = from 213.25.24.0 to 213.25.24.31 netmask of course 255.255.255.224. My firewall (Red Hat 9.0, latest kernel) public IP is 213.25.24.30 the = router address is 213.25.24.1 and the LAN network is 10.1.0.0/16. I've an internal mail server, say, 10.1.1.2 which I would like to see = from the outside as 213.25.24.3, one IP of my range. Except DNS registration, what are the correct steps to make this = possible? I just set this rule on my firewall: iptables -t nat -A PREROUTING -p tcp -i eth0 -d 213.25.24.3 --dport 25 = -j DNAT --to 10.1.1.2:25 but I guess it's not enough because it's not working. A help is really appreciated, thanks in advance. Roberto - Italy ------=_NextPart_000_005B_01C3A549.98FBF2B0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Hello all,

I've a range of 30 public internet = addresses to=20 manage starting, say, from 213.25.24.0 to 213.25.24.31 netmask of course = 255.255.255.224.

My firewall (Red Hat 9.0, latest=20 kernel) public IP is 213.25.24.30 the router address=20 is 213.25.24.1 and the LAN network is = 10.1.0.0/16.

I've an internal mail server, say, = 10.1.1.2 which=20 I would like to see from the outside as 213.25.24.3, one IP of my=20 range.

Except DNS registration, what are the = correct=20 steps to make this possible?

I just set this rule on my = firewall:

iptables -t nat -A PREROUTING -p tcp = -i eth0 -d=20 213.25.24.3 --dport 25 -j DNAT --to 10.1.1.2:25

but I guess it's not enough because = it's not=20 working.

A help is really appreciated, thanks = in=20 advance.

Roberto - Italy =20

------=_NextPart_000_005B_01C3A549.98FBF2B0-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: MOUDARIR Mohamed Subject: RE: mail server problem Date: Mon, 10 Nov 2003 14:43:47 -0000 Sender: netfilter-admin@lists.netfilter.org Message-ID: <14C5057BC852D611BAC400E0299AA10F2045D0@MAILSERV> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C3A799.0C26A540" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: Roberto Rossi , netfilter@lists.netfilter.org This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. ------_=_NextPart_001_01C3A799.0C26A540 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable May be you should also add this rule : iptables -A FORWARD -p TCP -i eth0 -o eth1 -d 10.1.1.2 --dport 25 -j = allowed eth1 is your NIC connected to your private LAN network is 10.1.0.0/16. -----Message d'origine----- De : Roberto Rossi [mailto:roberto.rossi@smc.it] Envoy=E9 : vendredi 7 novembre 2003 15:10 =C0 : netfilter@lists.netfilter.org Objet : mail server problem Hello all, =20 I've a range of 30 public internet addresses to manage starting, say, = from 213.25.24.0 to 213.25.24.31 netmask of course 255.255.255.224. =20 My firewall (Red Hat 9.0, latest kernel) public IP is 213.25.24.30 the router address is 213.25.24.1 and the LAN network is 10.1.0.0/16. =20 I've an internal mail server, say, 10.1.1.2 which I would like to see = from the outside as 213.25.24.3, one IP of my range. =20 Except DNS registration, what are the correct steps to make this = possible? =20 I just set this rule on my firewall: iptables -t nat -A PREROUTING -p tcp -i eth0 -d 213.25.24.3 --dport 25 = -j DNAT --to 10.1.1.2:25 but I guess it's not enough because it's not working. =20 A help is really appreciated, thanks in advance. =20 Roberto - Italy =20 ------_=_NextPart_001_01C3A799.0C26A540 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

May be you should also add this rule=20 :

iptables -A FORWARD -p TCP -i eth0 -o eth1 = -d 10.1.1.2=20 --dport 25 -j allowed
eth1 is = your NIC=20 connected to your private LAN network is=20 10.1.0.0/16.

-----Message=20 d'origine-----
De : Roberto Rossi=20 [mailto:roberto.rossi@smc.it]
Envoy=E9 : vendredi 7 = novembre 2003=20 15:10
=C0 : = netfilter@lists.netfilter.org
Objet :=20 mail server problem

Hello all,

I've a range of 30 public internet = addresses to=20 manage starting, say, from 213.25.24.0 to 213.25.24.31 netmask of = course=20 255.255.255.224.

My firewall (Red Hat 9.0, latest=20 kernel) public IP is 213.25.24.30 the router address=20 is 213.25.24.1 and the LAN network is = 10.1.0.0/16.

I've an internal mail server, say, = 10.1.1.2=20 which I would like to see from the outside as 213.25.24.3, one = IP of my=20 range.

Except DNS registration, what are = the correct=20 steps to make this possible?

I just set this rule on my=20 firewall:

iptables -t nat -A PREROUTING -p = tcp -i eth0 -d=20 213.25.24.3 --dport 25 -j DNAT --to 10.1.1.2:25

but I guess it's not enough = because it's not=20 working.

A help is really appreciated, = thanks in=20 advance.

Roberto - Italy =20

------_=_NextPart_001_01C3A799.0C26A540--