Maybe a Newbie question about SNAT/DNAT

Maybe a Newbie question about SNAT/DNAT

[melim]

I had some problems trying to set up my DMZ using iptables.

I have a valid IP in a interface eth2 and a internal net ip on eth0, I'm
using some well documented rules to redirect port requisitions to another
internal server.

iptables -t nat -A PREROUTING -p tcp --dport 80 -d 200.180.X.X -j
DNAT --to-destination 192.168.200.251
iptables -t nat -A POSTROUTING -p tcp --sport 80 -s 192.168.200.251 -j
SNAT --to-source 200.180.X.X

Sniffing with tcpdump in my webserver (192.168.200.251), I saw that the
requisition packets are comming.
But, there is no answer back to my browser or whatever.

I´ve put a LOG on postrouting in the "router" machine, and I can't see
anything comming back from the webserver, nether through tcpdump.

On the webserver I have a default gateway defined to another router, but
even removing it, won't work.
Only works when I defined the default GW to my router machine, but I don't
want to do this.

I'll be gratefull for any help,

and sorry for my poor english.

Re: Maybe a Newbie question about SNAT/DNAT

[Jörg Harmuth]

Hi Melim,

melim schrieb:
> 
> I have a valid IP in a interface eth2 and a internal net ip on eth0, I'm
> using some well documented rules to redirect port requisitions to another
> internal server.
> 
> iptables -t nat -A PREROUTING -p tcp --dport 80 -d 200.180.X.X -j
> DNAT --to-destination 192.168.200.251
> iptables -t nat -A POSTROUTING -p tcp --sport 80 -s 192.168.200.251 -j
> SNAT --to-source 200.180.X.X

...

> On the webserver I have a default gateway defined to another router, but
> even removing it, won't work.
> Only works when I defined the default GW to my router machine, but I don't
> want to do this.

So you DNAT HTTP requests to 192.168.200.251 and you SNAT the reponses
to 200.180.X.X. Ok so far. Some tcpdump would be nice, but I think you
can solve this with the following rule:

iptables -t nat -I POSTROUTING -p tcp -o eth0 --dport 80 \
         -j SNAT --to-source 192.168.200.254

This assumes that eth0 on your router is 192.168.200.254. I think this
happens:

Incoming request from e.g. 1.1.1.1. DNAT to 192.168.200.251. This packet
arrives at the web server:

dst: 192.168.200.251
src: 1.1.1.1 !!

As 1.1.1.1 is not known to the web server he sends it to his default
gateway, which is _not_ the router, so the packets vanish. tcpdump a bit
and probably you will see exactly this.

HTH and have a nice time,

Joerg