Re: Redirecting ports in a bridge

[Grant Taylor <gtaylor@riverviewtech.net>]

On 04/22/08 10:10, Javier Prieto Martínez wrote:
> Well.. I don't speak English very well, so it's easy to misunderstand my 
> posts :-)

That's ok.  You are doing just fine.  :)

> In your graph, "S" is my LAN with my all my servers and local 
> workstations. When I say that "I don't want to mess with the real IPs", 
> I mean I don't want to make any change within my LAN.

*nod*

Just to make sure that I understand you correctly, you do not want to 
have to re-configure IP addresses on servers when you add or remove the 
appliance but you do not care if a given server sees the traffic as 
being to its self rather than the original address.  I.e.

C -> S1 (client sends traffic)
C -> S1 (router routes traffic)
C -> S1 (appliance receives traffic)
C -> S2 (and changes it to S2      )
C -> S2 (server 2 receives traffic)
S2 -> C (server 2 replies to traffic)
S2 -> C (appliance receives traffic)
S1 -> C (and changes it to S1      )
S1 -> C (router routes traffic)
S1 -> C (client receives traffic)

The key point is that S2 sees the traffic as being to (destination IP) 
its self, rather than to S1.

If this is ok with you, then DNATing / SNATing will work just fine.

> The point of the redirection is that, when I need to make a change in 
> one of my servers, I'd like my appliance to redirect all the traffic 
> coming from the extranet ("C") to another server. For example, if I have 
> to stop the web server while upgrading, I'd like all the traffic coming 
> from outside to reach another web server with a catched version of my 
> web page.

*nod*

> The proccess should be something like that:
> 
> * C starts a connection to S1, port 80
> * R routes that packet to my LAN
> * A captures that packet, and changes the destintation to S2, port 80
> * S2 generates a response to C
> * A captures that packet, and changes its source to S1, port 80
> * R routes that packet to the outside network
> * C gets a packet from S1, port 80

*nod*

> I'm making some tests with EBTables in my lab enviroment. 
> I'll tell you the results.

Ok.  Let me know if you need any thing else.

Remember that you will need to DNAT the inbound traffic and SNAT the 
outbound traffic too.

Also, if you are redirecting the traffic (originally to the downed 
server) to another up and functioning server, you have to be careful not 
to interfere with the other servers normally functioning traffic.

You can very simply write an EBTables rule to SNAT the traffic as it 
passes through the appliance.  However you have to make sure that you 
only SNAT the traffic that was originally DNATed and not all the traffic 
from S2.

> Thanks a lot.

You are welcome.



Grant. . . .