Re: Routing through PtP and iptables

[Pascal Hambourg <pascal.mail@plouf.fr.eu.org>]

Hello,

Antonio Di Bacco a écrit :
> 
> I have two identical linux boxes (A e B), each one with two interfaces: an 
> ethernet (eth0 with ip 192.168.1.50) and an hdlc (hdlc0). The two boxes are 
> only connected via a link through their hdlc interfaces. Because they have to 
> be  exactly the same, if I have to assign an ip address to hdlc0 of A then 
> the hdlc0 of B should have the same ip address. Each one should have a 
> default route that cannot coincide with the hdlc interface. Every linux box 
> has a web server. When I connect with my notebook to box A I want to reach 
> the web server on A typing in my browser http://192.168.1.50 and I want to 
> reach web server on B typing http://192.168.1.50:8080 .
> Some one knows how could it be possible?

I would choose a "fake" unused address $FAKE_IP, route it through the 
HDLC interface and NAT traffic on the HDLC link so that both source and 
destination addresses appear to be $FAKE_IP. Of course this address must 
not be assigned to any interface, else traffic to that address would be 
routed locally and that's not what you want.

Same setup on both boxes (not tested) :

# IP forwarding is assumed to be enabled by any means, e.g.
sysctl -w net.ipv4.ip_forward=1
# or
echo 1 > /proc/sys/net/ipv6/ip_forward

# add route to the fake address using 'route'
route add $FAKE_IP dev 'hdlc0'
# or using 'ip'
ip route add $FAKE_IP dev hdlc0

# forwarding box setup
# 1st step : NAT destination 192.168.1.50:8080 -> $FAKE_IP:80
iptables -t nat -A PREROUTING -d 192.168.1.50 -p tcp --dport 8080 \
   -j DNAT --to-destination $FAKE_IP:80

# 2nd step : NAT source on HDLC -> $FAKE_IP (for return path)
iptables -t nat -A POSTROUTING -o hdlc0 -d $FAKE_IP \
   -j SNAT --to-source $FAKE_IP

# server box setup
# NAT destination on HDLC $FAKE_IP -> 192.168.1.50
iptables -t nat -A PREROUTING -i hdlc0 -d $FAKE_IP \
   -j DNAT --to-destination 192.168.1.50