Re: Redirecting ports in a bridge

[Grant Taylor <gtaylor@riverviewtech.net>]

On 4/21/2008 1:55 AM, Javier Prieto Martínez wrote:
> Yes, It's multi-purpose: 
> http://www.eneotecnologia.com/products_en.html?TB_iframe=true&height=510&width=800
> - Firewall & QoS. High performance statefull firewall and quality of 
> service.
> - Web cache & content filter. Black and white list mode with LDAP or 
> AD authentication.
> - VPN. L2TP / IPSEC – X.509, NAT Traversal and high availability. 
> - IPS / IDS. Snort 2.6 based with hardware acceleration.
> - Load balancing. LVS based – L3/4 classification, different 
> algorithms.
> - High availability. VRRP (Router mode) and STP (Bridge mode).
> - Malware. Antivirus (ClamAV, Kaspersky), antispam (DSPAM, 
> Mailshell), antispyware (Kaspersky, PCTools or Sunbelt) with hardware 
> acceleration.
> - NetFlow probe. NetFlow v5/9 Probe.

*nod*

> We use it in bridge mode, mainly for traffic logging, and sometimes 
> for packet filtering.

Ok, to me logging is recording information and filtering is either 
allowing traffic to pass or not.  Based on your original post it sounds 
like you are wanting to do some re-direction of traffic too.  Is this 
correct?

> I still want the bridge to be totally transparent, and I don't want 
> to mess with the real IPs, as I don't want the probe to be a single 
> point of failure. In fact, it's network cards still work as a bridge 
> when the machine is down.

The bridge can not be totally transparent and change things at the same 
time.  If you are having the bridge change things, the network will 
operate differently with it in verses out of service.  Please clarify 
what you are wanting.

> I suppose I should use SNAT, then, as you've stated, but it doesn't 
> seem to work properly. I'm trying that:
> 
> # iptables -t nat -A PREROUTING -p tcp -d 192.168.2.1 --dport 80 
> --to-destination 192.168.2.2:80 -j DNAT
> # iptables -t nat -A POSTROUTING -p tcp --sport 80 -s 192.168.2.2 -d 
> 192.168.1.0/24 -j SNAT --to-source 192.168.2.1


Remember that IPTables operates on layer 3 and EBTables operates on 
layer 2.  So unless you have your kernel configured to do such, IPTables 
will not see layer 2 traffic.  So, either you need to use EBTables 
(preferred in my opinion) or you need to configure your kernel so that 
IPTables sees layer 2 traffic.



Grant. . . .