Re: NAT issue on a machine with both routing and bridging.

[Grant Taylor <gtaylor@riverviewtech.net>]

On 06/23/08 11:00, Francois Goudal wrote:
> I'm sorry, this is my mistake, you should replace xenbr0 by br2 in all 
> what I said, this is because I have done the setup again on another 
> machine and I didn't name everything exactly the same.

*nod*

> Anyway, iptables-save returns :
> 
> # Generated by iptables-save v1.3.6 on Mon Jun 23 19:21:32 2008
> *raw
> :PREROUTING ACCEPT [38549:54443202]
> :OUTPUT ACCEPT [21429:1190521]
> COMMIT
> # Completed on Mon Jun 23 19:21:32 2008
> # Generated by iptables-save v1.3.6 on Mon Jun 23 19:21:32 2008
> *nat
> :PREROUTING ACCEPT [3560:445076]
> :POSTROUTING ACCEPT [520:47639]
> :OUTPUT ACCEPT [15:913]
> -A POSTROUTING -o br2 -j MASQUERADE
> COMMIT
> # Completed on Mon Jun 23 19:21:32 2008
> # Generated by iptables-save v1.3.6 on Mon Jun 23 19:21:32 2008
> *filter
> :INPUT ACCEPT [37185:54270101]
> :FORWARD ACCEPT [3367:880373]
> :OUTPUT ACCEPT [21464:1197423]
> COMMIT
> # Completed on Mon Jun 23 19:21:32 2008

Ok, there is nothing that is preventing things from working.

> And as I said, I tried with -o eth0 directly as well, but this doesn't 
> work better.

Hum.

> Actually this might be the case. I'm running a standard debian etch 
> kernel for the moment. I can consider building my own kernel, if 
> necessary. What is the kernel option I shouldn't enable ?

The option that I'm referring to is "CONFIG_BRIDGE_NETFILTER".  This 
option sets whether or not IPTables (layer 3 and above) sees bridged 
(layer 2) traffic or not.

> s/xenbr0/br2/ sorry :-)

*nod*

> No, I was just confused sorry, I think this is the good interface actually.

Agreed.

> Yes, I hope it will work at some point.
> I will have a look to what you pointed regarding the option in the 
> kernel to have bridged packets not going through IPtables.

I don't see any thing in what you have presented that will make this be 
a problem with the configuration that you have described.

> Thanks :-)

*nod*

I don't see any thing that (in theory) should not work.  The only thing 
that comes to mind is to temporarily remove Host B (DomU) from the mix 
and bridge br1 directly to eth1 and try your MASQUERADing between two 
bridge interfaces.

The only other thing that comes to mind is that you may be trying to nat 
existing connections, which can not be done because only the first 
packet in the connection passes through the NAT table.  But I don't 
think this is likely.



Grant. . . .