FORWARD RULE -- please help

FORWARD RULE -- please help

[Nilesh]

Hello 

Can anyone please help me regarding Packet Forwarding 
The condition is 
203.129.224.149 is my firewall machine running
IPTABLES and 192.168.0.22 is my local machine on 2090
port service is running

and another client side is 

202.129.227.3 is his firewall IP and 192.168.1.25 is
his local machine where on 2090 port services is
running 

I want to communicate this both internal
machines(192.168.0.22 and 192.168.1.25) through
firewall 

They are already allowd connection from my IP and Port
in his firewall machine but I want to allow him at my
side  

The flow is like 

192.168.0.22:2090
--->203.129.224.149--->203.129.227.3-->192.168.1.25:2090
now it will take acknowledment and come back to source
the process is reverse
192.168.1.25:2090-->203.129.227.3--->203.129.224.149:2090-->192.168.0.22:2090

could any one please tell me the rule.

Thanks 


__________________________________
Do you Yahoo!?
Yahoo! Search - Find what you’re looking for faster
http://search.yahoo.com

Re: FORWARD RULE -- please help

[Antony Stone]

On Tuesday 09 March 2004 7:54 am, Nilesh wrote:

> 203.129.224.149 is my firewall machine running
> IPTABLES and 192.168.0.22 is my local machine on 2090
> port service is running
>
> 202.129.227.3 is his firewall IP and 192.168.1.25 is
> his local machine where on 2090 port services is
> running
>
> I want to communicate this both internal
> machines(192.168.0.22 and 192.168.1.25) through
> firewall

If you want his 192.168.1.0/24 network to be able to communicate with your 
192.168.0.0/24 network then you should investigate IP in IP tunnelling / 
encapsulation (see the Linux Advanced Routing Guide at http://lartc.org for a 
simple guide to how to do this), or else set up a VPN (eg : FreeS/WAN, or the 
IPsec implementation built into the 2.6 kernel).

Regards,

Antony.

-- 
If at first you don't succeed, destroy all the evidence that you tried.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: FORWARD RULE -- please help

[Alexander Samad]

[-- Attachment #1: Type: text/plain, Size: 1666 bytes --]

On Tue, Mar 09, 2004 at 08:46:46AM +0000, Antony Stone wrote:
> On Tuesday 09 March 2004 7:54 am, Nilesh wrote:
> 
> > 203.129.224.149 is my firewall machine running
> > IPTABLES and 192.168.0.22 is my local machine on 2090
> > port service is running
> >
> > 202.129.227.3 is his firewall IP and 192.168.1.25 is
> > his local machine where on 2090 port services is
> > running
> >
> > I want to communicate this both internal
> > machines(192.168.0.22 and 192.168.1.25) through
> > firewall
> 
> If you want his 192.168.1.0/24 network to be able to communicate with your 
> 192.168.0.0/24 network then you should investigate IP in IP tunnelling / 
> encapsulation (see the Linux Advanced Routing Guide at http://lartc.org for a 
> simple guide to how to do this), or else set up a VPN (eg : FreeS/WAN, or the 
> IPsec implementation built into the 2.6 kernel).

Or he could use MASQ on both sides with 2 dnat rules

on 203.129.224.149

iptables -t nat -I postrouting -o IF_INTERNET -s 192.168.0.22 -p tcp
--dport 2090 -j MASQUERADE

iptables -t nat -I prerouting -i IF_INTERNET -d 203.129.224.149 -s
202.129.227.3 -p tcp --dport 2090 -j DNAT 192.168.0.22 

iptabes -t filter -I INPUT -i IF_INTERNET -d 203.129.224.149 -p tcp
--dport 2090

and then the reverse on the other side.  Presumed tcp and could use SNAT
instead of MASQ


> 
> Regards,
> 
> Antony.
> 
> -- 
> If at first you don't succeed, destroy all the evidence that you tried.
> 
>                                                      Please reply to the list;
>                                                            please don't CC me.
> 
> 
> 

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: FORWARD RULE -- please help

[Antony Stone]

On Tuesday 09 March 2004 9:10 am, Alexander Samad wrote:

> On Tue, Mar 09, 2004 at 08:46:46AM +0000, Antony Stone wrote:
> > On Tuesday 09 March 2004 7:54 am, Nilesh wrote:
> > > 203.129.224.149 is my firewall machine running
> > > IPTABLES and 192.168.0.22 is my local machine on 2090
> > > port service is running
> > >
> > > 202.129.227.3 is his firewall IP and 192.168.1.25 is
> > > his local machine where on 2090 port services is
> > > running
> > >
> > > I want to communicate this both internal
> > > machines(192.168.0.22 and 192.168.1.25) through
> > > firewall
> >
> > If you want his 192.168.1.0/24 network to be able to communicate with
> > your 192.168.0.0/24 network then you should investigate IP in IP
> > tunnelling / encapsulation (see the Linux Advanced Routing Guide at
> > http://lartc.org for a simple guide to how to do this), or else set up a
> > VPN (eg : FreeS/WAN, or the IPsec implementation built into the 2.6
> > kernel).
>
> Or he could use MASQ on both sides with 2 dnat rules

True, however this is not a scalable solution (won't work for more than one 
client or server at each end of the link for example), and it means that the 
client and server see the public addresses of the other end, not the private 
ones (although you could probably overcome this with another couple of SNAT 
rules loaded on top).

It would probably work okay in a restricted situation such as Nilesh 
specified, however.

Regards,

Antony.

-- 
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
A: Top-posting.
Q: What is the most annoying thing on usenet and in e-mail?

Re: FORWARD RULE -- please help

[Alexander Samad]

[-- Attachment #1: Type: text/plain, Size: 1896 bytes --]

On Tue, Mar 09, 2004 at 09:20:04AM +0000, Antony Stone wrote:
> On Tuesday 09 March 2004 9:10 am, Alexander Samad wrote:
> 
> > On Tue, Mar 09, 2004 at 08:46:46AM +0000, Antony Stone wrote:
> > > On Tuesday 09 March 2004 7:54 am, Nilesh wrote:
> > > > 203.129.224.149 is my firewall machine running
> > > > IPTABLES and 192.168.0.22 is my local machine on 2090
> > > > port service is running
> > > >
> > > > 202.129.227.3 is his firewall IP and 192.168.1.25 is
> > > > his local machine where on 2090 port services is
> > > > running
> > > >
> > > > I want to communicate this both internal
> > > > machines(192.168.0.22 and 192.168.1.25) through
> > > > firewall
> > >
> > > If you want his 192.168.1.0/24 network to be able to communicate with
> > > your 192.168.0.0/24 network then you should investigate IP in IP
> > > tunnelling / encapsulation (see the Linux Advanced Routing Guide at
> > > http://lartc.org for a simple guide to how to do this), or else set up a
> > > VPN (eg : FreeS/WAN, or the IPsec implementation built into the 2.6
> > > kernel).
> >
> > Or he could use MASQ on both sides with 2 dnat rules
> 
> True, however this is not a scalable solution (won't work for more than one 
> client or server at each end of the link for example), and it means that the 
> client and server see the public addresses of the other end, not the private 
> ones (although you could probably overcome this with another couple of SNAT 
> rules loaded on top).

true just doing it simple for the one off

> 
> It would probably work okay in a restricted situation such as Nilesh 
> specified, however.
> 
> Regards,
> 
> Antony.
> 
> -- 
> A: Because it messes up the order in which people normally read text.
> Q: Why is top-posting such a bad thing?
> A: Top-posting.
> Q: What is the most annoying thing on usenet and in e-mail?
> 
> 
> 

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]