Generic map, also with L4 protocol

Generic map, also with L4 protocol

[Marc SCHAEFER]

Hello,

for dynamic DNAT, I use:

   map multihoming_ext {
      type ipv4_addr . inet_service : ipv4_addr . inet_service
      elements = {
         46.140.72.218 . 8080  : 192.168.202.10 . 80,
         193.72.186.130 . 8080 : 192.168.202.10 . 80
      }
   }

   chain multihoming_prerouting {
      type nat hook prerouting priority -100; policy accept;

      dnat ip addr . port to ip daddr . tcp dport map @multihoming_ext
   }

This seems to DNAT correctly as wanted:

   46.140.72.218:8080 is DNATted to 192.168.202.10:80
and
   193.72.186.130:8080 is DATted to 192.168.202.10:80

To make it even more generic and dynamic, I would like to have also the
protocol in the map, something like:

   map multihoming_ext {
      type ipv4_addr . inet_proto . inet_service : ipv4_addr . inet_service
      elements = {
         46.140.72.218 . tcp . 8080  : 192.168.202.10 . 80,
         193.72.186.130 . tcp . 8080 : 192.168.202.10 . 80
      }
   }

However I have no idea how to modify the DNAT line itself to
get the L4 protocol from the map correctly.

Do you have any idea?

Thank you.

[SOLVED] Generic map, also with L4 protocol

[Marc SCHAEFER]

Hello,

The goal was to add the L4 protocol in a DNAT map which maps
an external IP and port to an internal (private) IP and
port, for external services mapping to internal services.

Thanks to Pablo Neira Ayuso:

>    map multihoming_ext {
>       type ipv4_addr . inet_service : ipv4_addr . inet_service

        type ipv4_addr . inet_proto . inet_service : ipv4_addr . inet_service

>       elements = {
>          46.140.72.218 . 8080  : 192.168.202.10 . 80,
>          193.72.186.130 . 8080 : 192.168.202.10 . 80
>       }
>    }

+         46.140.72.218  . tcp . 8080 : 192.168.202.10 . 80,
+         193.72.186.130 . tcp . 8080 : 192.168.202.10 . 80,
+         46.140.72.218  . udp . 5353 : 192.168.202.10 . 53

>       dnat ip addr . port to ip daddr . tcp dport map @multihoming_ext

        # @th: transport header; destination port
        dnat ip addr . port to ip daddr . meta l4proto . @th,16,16 map @multihoming_ext

I could test it and it works.