From mboxrd@z Thu Jan 1 00:00:00 1970 From: "adburne" Subject: NAT & MySQL Date: Tue, 25 Nov 2003 09:17:32 -0300 Sender: netfilter-admin@lists.netfilter.org Message-ID: <3FC3485C.000009.00204@adburne> Mime-Version: 1.0 Content-Type: Multipart/related; type="multipart/alternative"; boundary="------------Boundary-00=_85QWMY50000000000000" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter@lists.netfilter.org --------------Boundary-00=_85QWMY50000000000000 Content-Type: Multipart/Alternative; boundary="------------Boundary-00=_85QWH890000000000000" --------------Boundary-00=_85QWH890000000000000 Content-Type: Text/Plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Someone can make NAT with mysql? I've tried for a long time without make = it work.=0D =0D My natural language is spanish, sorry by mistakes writing in english.=0D =0D This is the situation:=0D =0D I've have a linux box as gateway between my lan and internet routing paqu= ets without problems, I need access from internet another linux box running apache and mysql on my private lan.=0D To do this work I try to use nat; with apache all works ok, but with mysq= l can't connect. I'll be looking on different network devices using tcpdump= to find what's wrong.=0D =0D This is what tcpdump show on device eth0 on my mysql server (inside the l= an) there is a petition from 200.10.10.1 (internet client) to 192.168.0.80 (mysql lan server), this reply with ack, but internet client don't =0D reply. Any clue? =3D)=0D =0D 200.10.10.1.56405 > 192.168.0.80.3306: S 2205542765:2205542765(0) win 584= 0 (DF)=0D 192.168.0.80.3306 > 200.10.10.1.56405: S 2497023396:2497023396(0) ack 2205542766=0D win 5792 (DF= )=0D 200.10.10.1.56405 > 192.168.0.80.3306: R 2205542766:2205542766(0) win 0 (= DF)=0D 200.10.10.1.56405 > 192.168.0.80.3306: S 2205542765:2205542765(0) win 584= 0 (DF)=0D 192.168.0.80.3306 > 200.10.10.1.56405: S 2503023731:2503023731(0) ack 2205542766=0D win 5792 (DF= )=0D 200.10.10.1.56405 > 192.168.0.80.3306: R 2205542766:2205542766(0) win 0 (= DF)=0D =0D =0D The forward rules on the gateway are:=0D =0D # "Accept forward all connections to port 3306 on ppp0"=0D iptables -A FORWARD -p tcp -i ppp0 --dport 3306 -o eth0 -j ACCEPT=0D # "All stablished connections are ok"=0D iptables -A FORWARD -i ppp0 -o eth0 -m state --state ESTABLISHED,RELATED = -j ACCEPT=0D # "All connection from inside to outside are accepted"=0D iptables -A FORWARD -i eth0 -o ppp0 -j ACCEPT=0D # "Rest go away"=0D iptables -A FORWARD -j REJECT=0D =0D NAT rule:=0D iptables -t nat -A PREROUTING -p tcp -i ppp0 --dport 3306 -j DNAT --to 19= 2 168.0.80 -s 200.10.10.1=0D =0D If someone can make the light turn on, thanks!!!!=0D =0D Alejandro --------------Boundary-00=_85QWH890000000000000 Content-Type: Text/HTML; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Someone can make NAT with mysql? I've tried for a long time without = make it work.

My natural language is spanish, sorry by mistakes writing in english= =2E

This is the situation:

I've have a linux box as gateway between my lan and internet routing= paquets without problems, I need access from internet another linux box = running apache and mysql on my private lan.

To do this work I try to use nat; with apache all works ok, but with= mysql can't connect. I'll be looking on different network devices using = tcpdump to find what's wrong.

This is what tcpdump show on device eth0 on my mysql server (inside = the lan), there is a petition from 200.10.10.1 (internet client) to 192.1= 68.0.80 (mysql lan server), this reply with ack, but internet client= don't

reply. Any clue? =3D)

200.10.10.1.56405 > 192.168.0.80.3306: S 2205542765:2205542765(0)= win 5840 <mss
1412,sackOK,timestamp 620645629 0,nop,wscale 0> (= DF)
192.168.0.80.3306 > 200.10.10.1.56405: S 2497023396:2497023396(= 0) ack 2205542766
win 5792 <mss 1460,sackOK,timestamp 9576465= 8 620645629,nop,wscale 0> (DF)
200.10.10.1.56405 > 192.168.0.80.= 3306: R 2205542766:2205542766(0) win 0 (DF)
200.10.10.1.56405 > 192= =2E168.0.80.3306: S 2205542765:2205542765(0) win 5840 <mss
1412,sac= kOK,timestamp 620648701 0,nop,wscale 0> (DF)
192.168.0.80.3306 >= 200.10.10.1.56405: S 2503023731:2503023731(0) ack 2205542766
wi= n 5792 <mss 1460,sackOK,timestamp 95765258 620648701,nop,wscale 0> = (DF)
200.10.10.1.56405 > 192.168.0.80.3306: R 2205542766:2205542766= (0) win 0 (DF)

The forward rules on the gateway are:

# "Accept forward all connections to port 3306 on ppp0"
ipta= bles -A FORWARD -p tcp -i ppp0 --dport 3306 -o eth0 -j ACCEPT

# "All stablished connections are ok"
iptables -A FORWA= RD -i ppp0 -o eth0 -m state --state ESTABLISHED,RELATED -j= ACCEPT
# "All connection from inside to outside are accepted"iptables -A FORWARD -i eth0 -o ppp0 -j ACCEPT

# "Rest go away"

iptables -A FORWARD -j REJECT

NAT rule:

iptables -t nat -A PREROUTING -p tcp -i ppp0 --dport 3306 -j DNAT --= to 192.168.0.80 -s 200.10.10.1

If someone can make the light turn on, thanks!!!!

Alejandro

______________________= ___________________________________________

IncrediMail = - El E-mail ha evolucionado finalmente - Haga clic aqu=ED<= /SPAN> --------------Boundary-00=_85QWH890000000000000-- --------------Boundary-00=_85QWMY50000000000000 Content-Type: image/gif; name="IMSTP.gif" Content-Transfer-Encoding: base64 Content-ID: <0E1EA367-1F3C-11D8-B817-00805F579555> R0lGODlhFAAPALMIAP9gAM9gAM8vAM9gL/+QL5AvAGAvAP9gL////wAAAAAAAAAAAAAAAAAAAAAA AAAAACH/C05FVFNDQVBFMi4wAwEAAAAh+QQJFAAIACwAAAAAFAAPAAAEVRDJSaudJuudrxlEKI6B URlCUYyjKpgYAKSgOBSCDEuGDKgrAtC3Q/R+hkPJEDgYCjpKr5A8WK9OaPFZwHoPqm3366VKyeRt E30tVVRscMHDqV/u+AgAIfkEBWQACAAsAAAAABQADwAABBIQyUmrvTjrzbv/YCiOZGmeaAQAIfkE CRQACAAsAgABABAADQAABEoQIUOrpXIOwrsPxiQUheeRAgUA49YNhbCqK1kS9grQhXGAhsDBUJgZ AL2Dcqkk7ogFpvRAokSn0p4PO6UIuUsQggSmFjKXdAgRAQAh+QQFCgAIACwAAAAAFAAPAAAEEhDJ Sau9OOvNu/9gKI5kaZ5oBAAh+QQJFAAIACwCAAEAEAANAAAEShAhQ6ulcg7Cuw/GJBSF55ECBQDj 1g2FsKorWRL2CtCFcYCGwMFQmBkAvYNyqSTuiAWm9ECiRKfSng87pQi5SxCCBKYWMpd0CBEBACH5 BAVkAAgALAAAAAAUAA8AAAQSEMlJq7046827/2AojmRpnmgEADs= --------------Boundary-00=_85QWMY50000000000000-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jeffrey Laramie Subject: Re: NAT & MySQL Date: Tue, 25 Nov 2003 12:19:16 -0500 Sender: netfilter-admin@lists.netfilter.org Message-ID: <3FC38F14.1050409@Loudoun-Fairfax.com> References: <3FC3485C.000009.00204@adburne> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <3FC3485C.000009.00204@adburne> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii"; format="flowed" To: netfilter@lists.netfilter.org adburne wrote: > The forward rules on the gateway are: > > # "Accept forward all connections to port 3306 on ppp0" > iptables -A FORWARD -p tcp -i ppp0 --dport 3306 -o eth0 -j ACCEPT > # "All stablished connections are ok" > iptables -A FORWARD -i ppp0 -o eth0 -m state --state > ESTABLISHED,RELATED -j ACCEPT > # "All connection from inside to outside are accepted" > iptables -A FORWARD -i eth0 -o ppp0 -j ACCEPT > # "Rest go away" > iptables -A FORWARD -j REJECT > > NAT rule: > iptables -t nat -A PREROUTING -p tcp -i ppp0 --dport 3306 -j DNAT --to > 192.168.0.80 -s 200.10.10.1 > Are you using MASQUERADE or SNAT ? If you aren't then the outside can't 'see' your internal server. Jeff From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Mark E. Donaldson" Subject: RE: NAT & MySQL Date: Tue, 25 Nov 2003 11:23:48 -0800 Sender: netfilter-admin@lists.netfilter.org Message-ID: <200311251923.hAPJNpiu001203@server5.bandwidthco.com> References: <3FC3485C.000009.00204@adburne> Reply-To: Mime-Version: 1.0 Content-Type: multipart/related; boundary="----=_NextPart_000_001C_01C3B346.98669C50" Return-path: In-Reply-To: <3FC3485C.000009.00204@adburne> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: 'adburne' , netfilter@lists.netfilter.org This is a multi-part message in MIME format. ------=_NextPart_000_001C_01C3B346.98669C50 Content-Type: multipart/alternative; boundary="----=_NextPart_001_001D_01C3B346.98690D50" ------=_NextPart_001_001D_01C3B346.98690D50 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable The ACK packets you see in your dump are probably being dropped at the firewall because a state table entry does not exist. So you need to add = a NEW rule to do this: =20 iptables -A FORWARD -i ppp0 -o eth0 -m state --state NEW -j ACCEPT =20 this rule will then allow your ESTABLISHED,RELATED rule to work and = permit those ACK packets to pass. _____ =20 From: netfilter-admin@lists.netfilter.org [mailto:netfilter-admin@lists.netfilter.org] On Behalf Of adburne Sent: Tuesday, November 25, 2003 4:18 AM To: netfilter@lists.netfilter.org Subject: NAT & MySQL Someone can make NAT with mysql? I've tried for a long time without make = it work. =20 My natural language is spanish, sorry by mistakes writing in english. =20 This is the situation: =20 I've have a linux box as gateway between my lan and internet routing = paquets without problems, I need access from internet another linux box running apache and mysql on my private lan. To do this work I try to use nat; with apache all works ok, but with = mysql can't connect. I'll be looking on different network devices using = tcpdump to find what's wrong. =20 This is what tcpdump show on device eth0 on my mysql server (inside the lan), there is a petition from 200.10.10.1 (internet client) to = 192.168.0.80 (mysql lan server), this reply with ack, but internet client don't=20 reply. Any clue? =3D) =20 200.10.10.1.56405 > 192.168.0.80.3306: S 2205542765:2205542765(0) win = 5840 (DF) 192.168.0.80.3306 > 200.10.10.1.56405: S 2497023396:2497023396(0) ack 2205542766 win 5792 = (DF) 200.10.10.1.56405 > 192.168.0.80.3306: R 2205542766:2205542766(0) win 0 = (DF) 200.10.10.1.56405 > 192.168.0.80.3306: S 2205542765:2205542765(0) win = 5840 (DF) 192.168.0.80.3306 > 200.10.10.1.56405: S 2503023731:2503023731(0) ack 2205542766 win 5792 = (DF) 200.10.10.1.56405 > 192.168.0.80.3306: R 2205542766:2205542766(0) win 0 = (DF) =20 The forward rules on the gateway are: =20 # "Accept forward all connections to port 3306 on ppp0" iptables -A FORWARD -p tcp -i ppp0 --dport 3306 -o eth0 -j ACCEPT # "All stablished connections are ok" iptables -A FORWARD -i ppp0 -o eth0 -m state --state ESTABLISHED,RELATED = -j ACCEPT # "All connection from inside to outside are accepted" iptables -A FORWARD -i eth0 -o ppp0 -j ACCEPT # "Rest go away" iptables -A FORWARD -j REJECT =20 NAT rule: iptables -t nat -A PREROUTING -p tcp -i ppp0 --dport 3306 -j DNAT --to 192.168.0.80 -s 200.10.10.1 =20 If someone can make the light turn on, thanks!!!! =20 Alejandro =20 =09 _________________________________________________________________ = IncrediMail - El E-mail ha evolucionado finalmente - Haga clic = aqu=ED ------=_NextPart_001_001D_01C3B346.98690D50 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

The ACK=20 packets you see in your dump are probably being dropped at the firewall = because=20 a state table entry does not exist. So you need to add a NEW rule = to do=20 this:

iptables -A FORWARD -i ppp0 -o eth0 -m state = --state NEW=20 -j ACCEPT

this = rule will=20 then allow your ESTABLISHED,RELATED rule to work and permit those ACK = packets to=20 pass.

From: = netfilter-admin@lists.netfilter.org=20 [mailto:netfilter-admin@lists.netfilter.org] On Behalf Of=20 adburne
Sent: Tuesday, November 25, 2003 4:18 = AM
To:=20 netfilter@lists.netfilter.org
Subject: NAT &=20 MySQL

Someone can make NAT with mysql? I've tried for a long time = without=20 make it work.

My natural language is spanish, sorry by mistakes writing in=20 english.

This is the situation:

I've have a linux box as gateway between my lan and internet = routing=20 paquets without problems, I need access from internet another = linux box=20 running apache and mysql on my private lan.

To do this work I try to use nat; with apache all works ok, = but with=20 mysql can't connect. I'll be looking on different network devices = using=20 tcpdump to find what's wrong.

This is what tcpdump show on device eth0 on my mysql server = (inside=20 the lan), there is a petition from 200.10.10.1 (internet client) = to=20 192.168.0.80 (mysql lan server), this reply with ack, but = internet=20 client don't

reply. Any clue? =3D)

200.10.10.1.56405 > 192.168.0.80.3306: S = 2205542765:2205542765(0)=20 win 5840 <mss
1412,sackOK,timestamp 620645629 0,nop,wscale = 0>=20 (DF)
192.168.0.80.3306 > 200.10.10.1.56405: S=20 2497023396:2497023396(0) ack 2205542766
win 5792 <mss=20 1460,sackOK,timestamp 95764658 620645629,nop,wscale 0>=20 (DF)
200.10.10.1.56405 > 192.168.0.80.3306: R=20 2205542766:2205542766(0) win 0 (DF)
200.10.10.1.56405 >=20 192.168.0.80.3306: S 2205542765:2205542765(0) win 5840=20 <mss
1412,sackOK,timestamp 620648701 0,nop,wscale 0>=20 (DF)
192.168.0.80.3306 > 200.10.10.1.56405: S=20 2503023731:2503023731(0) ack 2205542766
win 5792 <mss=20 1460,sackOK,timestamp 95765258 620648701,nop,wscale 0>=20 (DF)
200.10.10.1.56405 > 192.168.0.80.3306: R=20 2205542766:2205542766(0) win 0 (DF)

The forward rules on the gateway are:

# "Accept forward all connections to port 3306 on=20 ppp0"
iptables -A FORWARD -p tcp -i ppp0 --dport 3306 -o eth0 = -j=20 ACCEPT

# "All stablished connections are = ok"
iptables -A=20 FORWARD -i ppp0 -o eth0 -m state --state=20 ESTABLISHED,RELATED -j ACCEPT
# "All connection from = inside=20 to outside are accepted"
iptables -A FORWARD -i eth0=20 -o ppp0 -j ACCEPT

# "Rest go away"

iptables -A FORWARD -j REJECT

NAT rule:

iptables -t nat -A PREROUTING -p tcp -i ppp0 --dport 3306 -j = DNAT=20 --to 192.168.0.80 -s 200.10.10.1

If someone can make the light turn on, thanks!!!!

Alejandro

________________________________________________________________= _
<= IMG alt=3D""=20 hspace=3D0 src=3D"cid:268012019@25112003-2959" align=3Dbaseline = border=3D0> =20 IncrediMail - El E-mail ha evolucionado finalmente - = <= FONT=20 face=3D"Times New Roman" size=3D3>Haga clic=20 aqu=ED ------=_NextPart_001_001D_01C3B346.98690D50-- ------=_NextPart_000_001C_01C3B346.98669C50 Content-Type: image/gif; name="IMSTP.gif" Content-Transfer-Encoding: base64 Content-ID: <268012019@25112003-2959> R0lGODlhFAAPALMIAP9gAM9gAM8vAM9gL/+QL5AvAGAvAP9gL////wAAAAAAAAAAAAAAAAAAAAAA AAAAACH/C05FVFNDQVBFMi4wAwEAAAAh+QQJFAAIACwAAAAAFAAPAAAEVRDJSaudJuudrxlEKI6B URlCUYyjKpgYAKSgOBSCDEuGDKgrAtC3Q/R+hkPJEDgYCjpKr5A8WK9OaPFZwHoPqm3366VKyeRt E30tVVRscMHDqV/u+AgAIfkEBWQACAAsAAAAABQADwAABBIQyUmrvTjrzbv/YCiOZGmeaAQAIfkE CRQACAAsAgABABAADQAABEoQIUOrpXIOwrsPxiQUheeRAgUA49YNhbCqK1kS9grQhXGAhsDBUJgZ AL2Dcqkk7ogFpvRAokSn0p4PO6UIuUsQggSmFjKXdAgRAQAh+QQFCgAIACwAAAAAFAAPAAAEEhDJ Sau9OOvNu/9gKI5kaZ5oBAAh+QQJFAAIACwCAAEAEAANAAAEShAhQ6ulcg7Cuw/GJBSF55ECBQDj 1g2FsKorWRL2CtCFcYCGwMFQmBkAvYNyqSTuiAWm9ECiRKfSng87pQi5SxCCBKYWMpd0CBEBACH5 BAVkAAgALAAAAAAUAA8AAAQSEMlJq7046827/2AojmRpnmgEADs= ------=_NextPart_000_001C_01C3B346.98669C50-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jeffrey Laramie Subject: Re: NAT & MySQL Date: Tue, 25 Nov 2003 16:24:55 -0500 Sender: netfilter-admin@lists.netfilter.org Message-ID: <3FC3C8A7.2030301@Loudoun-Fairfax.com> References: <200311251923.hAPJNpiu001203@server5.bandwidthco.com> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <200311251923.hAPJNpiu001203@server5.bandwidthco.com> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii"; format="flowed" To: netfilter@lists.netfilter.org Mark E. Donaldson wrote: > The ACK packets you see in your dump are probably being dropped at the > firewall because a state table entry does not exist. So you need to > add a NEW rule to do this: > > iptables -A FORWARD -i ppp0 -o eth0 -m state --state NEW -j ACCEPT > > this rule will then allow your ESTABLISHED,RELATED rule to work and > permit those ACK packets to pass. > > Hi Mark, I'm not sure I understand what this rule does for him. Only the first packet from the web client would be NEW and based on his FORWARD rules that's been accepted and the dump shows it went through (although I'd still like to see his SNAT rule). Your rule would open his mysql server to any NEW packet. Are you saying that the RELATED ACK packets won't go through unless the first packet is matched with a NEW state and makes an entry in the state table? Jeff From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Mark E. Donaldson" Subject: RE: NAT & MySQL Date: Tue, 25 Nov 2003 18:56:51 -0800 Sender: netfilter-admin@lists.netfilter.org Message-ID: <200311260256.hAQ2usiu004660@server5.bandwidthco.com> References: <3FC3C8A7.2030301@Loudoun-Fairfax.com> Reply-To: Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <3FC3C8A7.2030301@Loudoun-Fairfax.com> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: 'Jeffrey Laramie' , netfilter@lists.netfilter.org Yeah you are correct Jeff. Don't know what I was thinking. Maybe that's the problem: I wasn't. -----Original Message----- From: netfilter-admin@lists.netfilter.org [mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Jeffrey Laramie Sent: Tuesday, November 25, 2003 1:25 PM To: netfilter@lists.netfilter.org Subject: Re: NAT & MySQL Mark E. Donaldson wrote: > The ACK packets you see in your dump are probably being dropped at the > firewall because a state table entry does not exist. So you need to > add a NEW rule to do this: > > iptables -A FORWARD -i ppp0 -o eth0 -m state --state NEW -j ACCEPT > > this rule will then allow your ESTABLISHED,RELATED rule to work and > permit those ACK packets to pass. > > Hi Mark, I'm not sure I understand what this rule does for him. Only the first packet from the web client would be NEW and based on his FORWARD rules that's been accepted and the dump shows it went through (although I'd still like to see his SNAT rule). Your rule would open his mysql server to any NEW packet. Are you saying that the RELATED ACK packets won't go through unless the first packet is matched with a NEW state and makes an entry in the state table? Jeff From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jeffrey Laramie Subject: Re: NAT & MySQL Date: Tue, 25 Nov 2003 22:38:01 -0500 Sender: netfilter-admin@lists.netfilter.org Message-ID: <3FC42019.4030704@Loudoun-Fairfax.com> References: <200311260256.hAQ2usiu004660@server5.bandwidthco.com> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <200311260256.hAQ2usiu004660@server5.bandwidthco.com> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/html; charset="us-ascii" To: netfilter@lists.netfilter.org Mark E. Donaldson wrote:

Yeah you are correct Jeff.  Don't know what I was thinking. Maybe that's the
problem: I wasn't.

No worries. This is a tough list to answer on (just ask Antony). One needs to understand inet protocols, the inner workings of netfilter, network design, and a whole bunch of unforgiving iptables rules. And that's before you get to POM and the bleeding edge stuff! This is why I only answer the easy questions ;-)

Anyway, the original post said that the web server worked fine yet there aren't any rules that would allow that. If you're still following the thread, can you post all your rules and maybe a schematic of your LAN so we can see where the servers are?

Jeff
From mboxrd@z Thu Jan 1 00:00:00 1970 From: "adburne" Subject: Re: NAT & MySQL Date: Thu, 27 Nov 2003 11:50:16 -0300 Sender: netfilter-admin@lists.netfilter.org Message-ID: <3FC60F28.000001.00267@adburne> References: <3FC42019.4030704@Loudoun-Fairfax.com> Mime-Version: 1.0 Content-Type: Multipart/related; type="multipart/alternative"; boundary="------------Boundary-00=_SJM0QL80000000000000" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter@lists.netfilter.org --------------Boundary-00=_SJM0QL80000000000000 Content-Type: Multipart/Alternative; boundary="------------Boundary-00=_SJM0LVC0000000000000" --------------Boundary-00=_SJM0LVC0000000000000 Content-Type: Text/Plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable How ever, thanks; I'll be found the reason that didn't work DNAT.=0D =0D Don't punch me =3D)=0D =0D I set up, time ago, another gateway box on my mysql server (I've 2 links = to internet), it runs rh7.1 and network setup was setting using linuxconf. I setup it correctly, but don't take changes.=0D It show incorrect information about gateway ip, when I saw this because I think in it, all was ok (in theory).=0D =0D Thanks, and sorry for waste your time (and my too) with this problem.=0D =0D Alejandro.=0D =0D -------Mensaje original-------=0D =0D De: Jeffrey Laramie=0D Fecha: mi=E9rcoles 26 de noviembre de 2003 00:51:40=0D A: netfilter@lists.netfilter.org=0D Asunto: Re: NAT & MySQL=0D =0D Mark E. Donaldson wrote:=0D =0D Yeah you are correct Jeff. Don't know what I was thinking. Maybe that's = the=0D problem: I wasn't.=0D =0D =0D =0D No worries. This is a tough list to answer on (just ask Antony). One need= s to understand inet protocols, the inner workings of netfilter, network design, and a whole bunch of unforgiving iptables rules. And that's befor= e you get to POM and the bleeding edge stuff! This is why I only answer the easy questions ;-)=0D =0D Anyway, the original post said that the web server worked fine yet there aren't any rules that would allow that. If you're still following the thr= ead can you post all your rules and maybe a schematic of your LAN so we can = see where the servers are?=0D =0D Jeff=0D =0D =20 --------------Boundary-00=_SJM0LVC0000000000000 Content-Type: Text/HTML; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

How ever, thanks; I'll be found the reason that didn't work DN= AT.

Don't punch me =3D)

I set up, time ago, another gateway box on my mysql server (I've 2 l= inks to internet), it runs rh7.1 and network setup was setting using linu= xconf. I setup it correctly, but don't take changes.

It show incorrect information about gateway ip, when I saw this= because I think in it, all was ok (in theory).

Thanks, and sorry for waste your time (and my too) with this problem= =2E

Alejandro.

-------Mensaje original-------

De: Jeffrey Laramie

Fecha: mi=E9rcoles= 26 de noviembre de 2003 00:51:40

A: netfilter@lists.netfilter.org

Asunto: Re: NAT &a= mp; MySQL

Mark E. Donaldson wrote:

Yeah you are correct Jeff.  Don't know what I wa=
s thinking. Maybe that's the
problem: I wasn't.

No worries. This is a tough list to answer on (just ask= Antony). One needs to understand inet protocols, the inner workings of n= etfilter, network design, and a whole bunch of unforgiving iptables rules= =2E And that's before you get to POM and the bleeding edge stuff! This is= why I only answer the easy questions ;-)

Anyway, the original pos= t said that the web server worked fine yet there aren't any rules that wo= uld allow that. If you're still following the thread, can you post all yo= ur rules and maybe a schematic of your LAN so we can see where the server= s are?

Jeff

______________________= ___________________________________________

IncrediMail = - El E-mail ha evolucionado finalmente - Haga clic aqu=ED<= /SPAN> --------------Boundary-00=_SJM0LVC0000000000000-- --------------Boundary-00=_SJM0QL80000000000000 Content-Type: image/gif; name="IMSTP.gif" Content-Transfer-Encoding: base64 Content-ID: <277FA103-20E7-11D8-B818-00805F579555> R0lGODlhFAAPALMIAP9gAM9gAM8vAM9gL/+QL5AvAGAvAP9gL////wAAAAAAAAAAAAAAAAAAAAAA AAAAACH/C05FVFNDQVBFMi4wAwEAAAAh+QQJFAAIACwAAAAAFAAPAAAEVRDJSaudJuudrxlEKI6B URlCUYyjKpgYAKSgOBSCDEuGDKgrAtC3Q/R+hkPJEDgYCjpKr5A8WK9OaPFZwHoPqm3366VKyeRt E30tVVRscMHDqV/u+AgAIfkEBWQACAAsAAAAABQADwAABBIQyUmrvTjrzbv/YCiOZGmeaAQAIfkE CRQACAAsAgABABAADQAABEoQIUOrpXIOwrsPxiQUheeRAgUA49YNhbCqK1kS9grQhXGAhsDBUJgZ AL2Dcqkk7ogFpvRAokSn0p4PO6UIuUsQggSmFjKXdAgRAQAh+QQFCgAIACwAAAAAFAAPAAAEEhDJ Sau9OOvNu/9gKI5kaZ5oBAAh+QQJFAAIACwCAAEAEAANAAAEShAhQ6ulcg7Cuw/GJBSF55ECBQDj 1g2FsKorWRL2CtCFcYCGwMFQmBkAvYNyqSTuiAWm9ECiRKfSng87pQi5SxCCBKYWMpd0CBEBACH5 BAVkAAgALAAAAAAUAA8AAAQSEMlJq7046827/2AojmRpnmgEADs= --------------Boundary-00=_SJM0QL80000000000000-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Alejandro D. Burne" Subject: NAT & MySQL Date: Thu, 27 Nov 2003 09:22:18 -0300 Sender: netfilter-admin@lists.netfilter.org Message-ID: <3FC5EC7A.000001.00196@adburne> References: <3FC4EDAA.6080009@Loudoun-Fairfax.com> Mime-Version: 1.0 Content-Type: Multipart/related; type="multipart/alternative"; boundary="------------Boundary-00=_6PF0QL80000000000000" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter@lists.netfilter.org --------------Boundary-00=_6PF0QL80000000000000 Content-Type: Multipart/Alternative; boundary="------------Boundary-00=_6PF0LVC0000000000000" --------------Boundary-00=_6PF0LVC0000000000000 Content-Type: Text/Plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable This is the schema:=0D =0D [internet]<-->[ppp0 (dynamic address) - Gateway - 192.168.1.122]<-->[192.= 168 1.252 - MySQL Server]=0D =0D and this is the script:=0D =0D #Setting the EXTERNAL and INTERNAL interfaces for the network=0D EXTIF=3D"ppp0"=0D INTIF=3D"eth0"=0D =0D # Determine the external IP automatically:=0D EXTIP=3D"`$IFCONFIG $EXTIF | $AWK \=0D /$EXTIF/'{next}//{split($0,a,":");split(a[2],a," ");print a[1];exit}'`"=0D =0D # Assign the internal TCP/IP network and IP address=0D INTNET=3D"192.168.1.0/24"=0D INTIP=3D"192.168.1.122/32"=0D =0D # Setting a few other local variables=0D UNIVERSE=3D"0.0.0.0/0"=0D =0D echo " - Verifying that all kernel modules are ok"=0D [... to be more small I supress many lines here...]=0D =0D echo " Enabling forwarding.."=0D echo "1" > /proc/sys/net/ipv4/ip_forward=0D echo " Enabling DynamicAddr.."=0D echo "1" > /proc/sys/net/ipv4/ip_dynaddr=0D =0D echo " Clearing any existing rules.."=0D $IPTABLES -P INPUT ACCEPT=0D $IPTABLES -F INPUT =0D $IPTABLES -P OUTPUT ACCEPT=0D $IPTABLES -F OUTPUT =0D $IPTABLES -P FORWARD DROP=0D $IPTABLES -F FORWARD =0D $IPTABLES -F -t nat=0D # Flush the user chain.. if it exists=0D if [ -n "`$IPTABLES -L | $GREP drop-and-log-it`" ]; then=0D $IPTABLES -F drop-and-log-it=0D fi=0D # Delete all User-specified chains=0D $IPTABLES -X=0D # Reset all IPTABLES counters=0D $IPTABLES -Z=0D =0D echo " Creating a DROP chain.."=0D $IPTABLES -N drop-and-log-it=0D $IPTABLES -A drop-and-log-it -j LOG --log-level info =0D $IPTABLES -A drop-and-log-it -j REJECT=0D =0D echo -e " - Loading FORWARD rulesets"=0D $IPTABLES -A FORWARD -i $EXTIF -p tcp --dport 3306 -o $INTIF -j ACCEPT=0D $IPTABLES -A FORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED RELATED \=0D -j ACCEPT=0D $IPTABLES -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT=0D # Catch all rule, all other forwarding is denied and logged. =0D $IPTABLES -A FORWARD -j drop-and-log-it=0D =0D =0D echo " - NAT: Enabling SNAT functionality on $EXTIF"=0D $IPTABLES -t nat -A PREROUTING -p tcp -i $EXTIF --dport 3306 -j DNAT --to 192.168.1.252:3306=0D $IPTABLES -t nat -A POSTROUTING -o $EXTIF -j SNAT --to $EXTIP=0D =0D Alejandro --------------Boundary-00=_6PF0LVC0000000000000 Content-Type: Text/HTML; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

This is the schema:

[internet]<-->[ppp0 (dynamic address) - Gateway - 192.168= =2E1.122]<-->[192.168.1.252 - MySQL Server]

and this is the script:

#Setting the EXTERNAL and INTERNAL interfaces for the network
EXT= IF=3D"ppp0"
INTIF=3D"eth0"

# Determine the external IP automatically:
EXTIP=3D"`$IFCONFIG $E= XTIF | $AWK \
/$EXTIF/'{next}//{split($0,a,":");split(a[2],a," "= );print a[1];exit}'`"

# Assign the internal TCP/IP network and IP address
INTNET=3D"192= =2E168.1.0/24"
INTIP=3D"192.168.1.122/32"

# Setting a few other local variables
UNIVERSE=3D"0.0.0.0/0"

echo " - Verifying that all kernel modules are ok"
[... to = be more small I supress many lines here...]

echo " Enabling forwarding.."
echo "1" > /proc/sys/net/i= pv4/ip_forward
echo " Enabling DynamicAddr.."
echo "1" > /= proc/sys/net/ipv4/ip_dynaddr

echo " Clearing any existing rules.."
$IPTABLES -P INPUT AC= CEPT
$IPTABLES -F INPUT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -F= OUTPUT
$IPTABLES -P FORWARD DROP
$IPTABLES -F FORWARD
$IPTABL= ES -F -t nat
# Flush the user chain.. if it exists
if [ -n "`$IPTAB= LES -L | $GREP drop-and-log-it`" ]; then
$IPTABLES -F dro= p-and-log-it
fi
# Delete all User-specified chains
$IPTABLES -X<= BR># Reset all IPTABLES counters
$IPTABLES -Z

echo " Creating a DROP chain.."
$IPTABLES -N drop-and-log-i= t
$IPTABLES -A drop-and-log-it -j LOG --log-level info
$IPTABLES -= A drop-and-log-it -j REJECT

echo -e " - Loading FORWARD rulesets"
$IPTABLES -A FO= RWARD -i $EXTIF -p tcp --dport 3306 -o $INTIF -j ACCEPT
$IPTABLES -A F= ORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED,RELATED \
&nbs= p;-j ACCEPT
$IPTABLES -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT
# Ca= tch all rule, all other forwarding is denied and logged.
$IPTABLES -A= FORWARD -j drop-and-log-it

echo " - NAT: Enabling SNAT functionalit= y on $EXTIF"
$IPTABLES -t nat -A PREROUTING -p tcp -i $EXTIF --dport 3= 306 -j DNAT --to 192.168.1.252:3306
$IPTABLES -t nat -A POSTROUTING -o= $EXTIF -j SNAT --to $EXTIP

Alejandro

______________________= ___________________________________________

IncrediMail = - El E-mail ha evolucionado finalmente - Haga clic aqu=ED<= /SPAN> --------------Boundary-00=_6PF0LVC0000000000000-- --------------Boundary-00=_6PF0QL80000000000000 Content-Type: image/gif; name="IMSTP.gif" Content-Transfer-Encoding: base64 Content-ID: <68A9AED4-20D0-11D8-B818-00805F579555> R0lGODlhFAAPALMIAP9gAM9gAM8vAM9gL/+QL5AvAGAvAP9gL////wAAAAAAAAAAAAAAAAAAAAAA AAAAACH/C05FVFNDQVBFMi4wAwEAAAAh+QQJFAAIACwAAAAAFAAPAAAEVRDJSaudJuudrxlEKI6B URlCUYyjKpgYAKSgOBSCDEuGDKgrAtC3Q/R+hkPJEDgYCjpKr5A8WK9OaPFZwHoPqm3366VKyeRt E30tVVRscMHDqV/u+AgAIfkEBWQACAAsAAAAABQADwAABBIQyUmrvTjrzbv/YCiOZGmeaAQAIfkE CRQACAAsAgABABAADQAABEoQIUOrpXIOwrsPxiQUheeRAgUA49YNhbCqK1kS9grQhXGAhsDBUJgZ AL2Dcqkk7ogFpvRAokSn0p4PO6UIuUsQggSmFjKXdAgRAQAh+QQFCgAIACwAAAAAFAAPAAAEEhDJ Sau9OOvNu/9gKI5kaZ5oBAAh+QQJFAAIACwCAAEAEAANAAAEShAhQ6ulcg7Cuw/GJBSF55ECBQDj 1g2FsKorWRL2CtCFcYCGwMFQmBkAvYNyqSTuiAWm9ECiRKfSng87pQi5SxCCBKYWMpd0CBEBACH5 BAVkAAgALAAAAAAUAA8AAAQSEMlJq7046827/2AojmRpnmgEADs= --------------Boundary-00=_6PF0QL80000000000000--