Hello folks..
Does any of you know if it is possible to rewrite the ip src in a packet.
I have a problem involving a DMZ with external IP addresses routed
trough a single WAN IP. When the server initiates a connection, it looks
like it comes from the WAN ip instead of it''s designated External IP
routed through the WAN.
So in short, Is it possible to rewrite the packet in the router, with
Iptables, to make it look like it comes from the external IP address
instead of the WAN IP of the router/firewall.
Thank you very much for your time, I appreciate it.
/Daniel Frederiksen
NB: Small diagram of the setup.
DMZ GW/FW ISP/Internet
-----------------------------------------------------------------------
Server #1 --|
e.f.g.h3/26 |
|---- Gateway/Firewall --- ISP WAN IP: a.b.c.d/30
Server #2 --| a.b.c.d1/30 Ext. IP: e.f.g.h/26
e.f.g.h4/26 e.f.g.h1/26
----------------------------------------------------------------------
Maybe I have missed somthing and you need to do it in POSTROUTING but how about SNAT. PS: ip can do stateless nat. On Tue, 2005- 10-25 at 14:36 +0200, Daniel Frederiksen wrote:> Hello folks.. > > Does any of you know if it is possible to rewrite the ip src in a packet. > I have a problem involving a DMZ with external IP addresses routed > trough a single WAN IP. When the server initiates a connection, it looks > like it comes from the WAN ip instead of it''s designated External IP > routed through the WAN. > So in short, Is it possible to rewrite the packet in the router, with > Iptables, to make it look like it comes from the external IP address > instead of the WAN IP of the router/firewall. > > Thank you very much for your time, I appreciate it. > > /Daniel Frederiksen > > > NB: Small diagram of the setup. > > DMZ GW/FW ISP/Internet > ----------------------------------------------------------------------- > Server #1 --| > e.f.g.h3/26 | > |---- Gateway/Firewall --- ISP WAN IP: a.b.c.d/30 > Server #2 --| a.b.c.d1/30 Ext. IP: e.f.g.h/26 > e.f.g.h4/26 e.f.g.h1/26 > ---------------------------------------------------------------------- > > _______________________________________________ > LARTC mailing list > LARTC@mailman.ds9a.nl > http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
Oscar Mechanic wrote:> Maybe I have missed somthing and you need to do it in POSTROUTING but > how about SNAT. >Well currently I do not NAT at all. I have ip_forwarding enabled and have assigned the first IP from the external block on the inside of the Gateway/Firewall. On the outside of the Gateway/Firewall I have assigned the WAN IP. This way when a system on the DMZ establishes a connection it is forwarded through the Gateway. Any suggestions to changes are appreciated. /Daniel..> PS: ip can do stateless nat. > > On Tue, 2005- > 10-25 at 14:36 +0200, Daniel Frederiksen wrote: > >>Hello folks.. >> >>Does any of you know if it is possible to rewrite the ip src in a packet. >>I have a problem involving a DMZ with external IP addresses routed >>trough a single WAN IP. When the server initiates a connection, it looks >>like it comes from the WAN ip instead of it''s designated External IP >>routed through the WAN. >>So in short, Is it possible to rewrite the packet in the router, with >>Iptables, to make it look like it comes from the external IP address >>instead of the WAN IP of the router/firewall. >> >>Thank you very much for your time, I appreciate it. >> >>/Daniel Frederiksen >> >> >>NB: Small diagram of the setup. >> >> DMZ GW/FW ISP/Internet >>----------------------------------------------------------------------- >> Server #1 --| >> e.f.g.h3/26 | >> |---- Gateway/Firewall --- ISP WAN IP: a.b.c.d/30 >> Server #2 --| a.b.c.d1/30 Ext. IP: e.f.g.h/26 >> e.f.g.h4/26 e.f.g.h1/26 >>---------------------------------------------------------------------- >> >>_______________________________________________ >>LARTC mailing list >>LARTC@mailman.ds9a.nl >>http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc > >
So you want packets leaving the WAN to have address e.f.g.h/26 rather
than a.b.c.d/30
That would mean you ISP has assigned you the two ranges e.f.g.h and
a.b.c.d.
Your gateway cannot be a gateway from this diagram
That must be e.f.g.h/27 GW has
e.f.g.h/27 and e.f.g.h/26 interfaces
> >> DMZ GW/FW ISP/Internet
>
>>-----------------------------------------------------------------------
> >> Server #1 --|
> >> e.f.g.h3/26 |
> >> |---- Gateway/Firewall --- ISP WAN IP: a.b.c.d/30
> >> Server #2 --| a.b.c.d1/30 Ext. IP: e.f.g.h/26
> >> e.f.g.h4/26 e.f.g.h1/26
>
>>----------------------------------------------------------------------
I would assume what you will end up doing is
iptables -t nat -A POSTROUTING -m mac-source <MACSERVER1> -j SNAT --to-
source <ALIAS1 of GW>
iptables -t nat -A POSTROUTING -m mac-source <MACSERVER2> -j SNAT --to-
source <ALIAS2 of GW>
Where ALIAS1 and ALIAS2 are the IP''s of server 1 and server 2 aliased
on
the firewall
Regards
Shane
On Tue, 2005-10-25 at 14:58 +0200, Daniel Frederiksen
wrote:> Oscar Mechanic wrote:
> > Maybe I have missed somthing and you need to do it in POSTROUTING but
> > how about SNAT.
> >
>
> Well currently I do not NAT at all. I have ip_forwarding enabled and
> have assigned the first IP from the external block on the inside of the
> Gateway/Firewall. On the outside of the Gateway/Firewall I have assigned
> the WAN IP. This way when a system on the DMZ establishes a connection
> it is forwarded through the Gateway.
>
> Any suggestions to changes are appreciated.
>
> /Daniel..
>
> > PS: ip can do stateless nat.
> >
> > On Tue, 2005-
> > 10-25 at 14:36 +0200, Daniel Frederiksen wrote:
> >
> >>Hello folks..
> >>
> >>Does any of you know if it is possible to rewrite the ip src in a
packet.
> >>I have a problem involving a DMZ with external IP addresses routed
> >>trough a single WAN IP. When the server initiates a connection, it
looks
> >>like it comes from the WAN ip instead of it''s designated
External IP
> >>routed through the WAN.
> >>So in short, Is it possible to rewrite the packet in the router,
with
> >>Iptables, to make it look like it comes from the external IP
address
> >>instead of the WAN IP of the router/firewall.
> >>
> >>Thank you very much for your time, I appreciate it.
> >>
> >>/Daniel Frederiksen
> >>
> >>
> >>NB: Small diagram of the setup.
> >>
> >> DMZ GW/FW ISP/Internet
>
>>-----------------------------------------------------------------------
> >> Server #1 --|
> >> e.f.g.h3/26 |
> >> |---- Gateway/Firewall --- ISP WAN IP: a.b.c.d/30
> >> Server #2 --| a.b.c.d1/30 Ext. IP: e.f.g.h/26
> >> e.f.g.h4/26 e.f.g.h1/26
>
>>----------------------------------------------------------------------
> >>
> >>_______________________________________________
> >>LARTC mailing list
> >>LARTC@mailman.ds9a.nl
> >>http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
> >
> >
>
>
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
excuse my iptables -m mac --mac-source 00:20:23:20:20:20 You will do this cause you dont want your 26 to become a 27 and loose 3 addrs. Alias are no longer called aliases but for convenience On Tue, 2005-10-25 at 14:21 +0100, Oscar Mechanic wrote:> So you want packets leaving the WAN to have address e.f.g.h/26 rather > than a.b.c.d/30 > > That would mean you ISP has assigned you the two ranges e.f.g.h and > a.b.c.d. > > Your gateway cannot be a gateway from this diagram > > That must be e.f.g.h/27 GW has > e.f.g.h/27 and e.f.g.h/26 interfaces > > >> DMZ GW/FW ISP/Internet > > >>----------------------------------------------------------------------- > > >> Server #1 --| > > >> e.f.g.h3/26 | > > >> |---- Gateway/Firewall --- ISP WAN IP: a.b.c.d/30 > > >> Server #2 --| a.b.c.d1/30 Ext. IP: e.f.g.h/26 > > >> e.f.g.h4/26 e.f.g.h1/26 > > >>---------------------------------------------------------------------- > > I would assume what you will end up doing is > > iptables -t nat -A POSTROUTING -m mac-source <MACSERVER1> -j SNAT --to- > source <ALIAS1 of GW> > iptables -t nat -A POSTROUTING -m mac-source <MACSERVER2> -j SNAT --to- > source <ALIAS2 of GW> > > Where ALIAS1 and ALIAS2 are the IP''s of server 1 and server 2 aliased on > the firewall > > Regards > Shane > > On Tue, 2005-10-25 at 14:58 +0200, Daniel Frederiksen wrote: > > Oscar Mechanic wrote: > > > Maybe I have missed somthing and you need to do it in POSTROUTING but > > > how about SNAT. > > > > > > > Well currently I do not NAT at all. I have ip_forwarding enabled and > > have assigned the first IP from the external block on the inside of the > > Gateway/Firewall. On the outside of the Gateway/Firewall I have assigned > > the WAN IP. This way when a system on the DMZ establishes a connection > > it is forwarded through the Gateway. > > > > Any suggestions to changes are appreciated. > > > > /Daniel.. > > > > > PS: ip can do stateless nat. > > > > > > On Tue, 2005- > > > 10-25 at 14:36 +0200, Daniel Frederiksen wrote: > > > > > >>Hello folks.. > > >> > > >>Does any of you know if it is possible to rewrite the ip src in a packet. > > >>I have a problem involving a DMZ with external IP addresses routed > > >>trough a single WAN IP. When the server initiates a connection, it looks > > >>like it comes from the WAN ip instead of it''s designated External IP > > >>routed through the WAN. > > >>So in short, Is it possible to rewrite the packet in the router, with > > >>Iptables, to make it look like it comes from the external IP address > > >>instead of the WAN IP of the router/firewall. > > >> > > >>Thank you very much for your time, I appreciate it. > > >> > > >>/Daniel Frederiksen > > >> > > >> > > >>NB: Small diagram of the setup. > > >> > > >> DMZ GW/FW ISP/Internet > > >>----------------------------------------------------------------------- > > >> Server #1 --| > > >> e.f.g.h3/26 | > > >> |---- Gateway/Firewall --- ISP WAN IP: a.b.c.d/30 > > >> Server #2 --| a.b.c.d1/30 Ext. IP: e.f.g.h/26 > > >> e.f.g.h4/26 e.f.g.h1/26 > > >>---------------------------------------------------------------------- > > >> > > >>_______________________________________________ > > >>LARTC mailing list > > >>LARTC@mailman.ds9a.nl > > >>http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc > > > > > > > > > > > > _______________________________________________ > > LARTC mailing list > > LARTC@mailman.ds9a.nl > > http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc > > _______________________________________________ > LARTC mailing list > LARTC@mailman.ds9a.nl > http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
Oscar Mechanic wrote:> So you want packets leaving the WAN to have address e.f.g.h/26 rather > than a.b.c.d/30 > > That would mean you ISP has assigned you the two ranges e.f.g.h and > a.b.c.d.Well, yes my ISP has assigned me the two "classes", however the a.b.c.d/30 is a single IP through which the e.f.g.h/26 are routed through. The ISP is not routing the e.f.g.h/26 directly to the line, but through the single WAN IP a.b.c.e/30.. This is why all traffic going through is touched and marked as coming from the WAN instead of the External IP address. Any suggestions to solving that?. /Daniel> > Your gateway cannot be a gateway from this diagram > > That must be e.f.g.h/27 GW has > e.f.g.h/27 and e.f.g.h/26 interfaces > >>>> DMZ GW/FW ISP/Internet >>>>----------------------------------------------------------------------- >>>> Server #1 --| >>>> e.f.g.h3/26 | >>>> |---- Gateway/Firewall --- ISP WAN IP: a.b.c.d/30 >>>> Server #2 --| a.b.c.d1/30 Ext. IP: e.f.g.h/26 >>>> e.f.g.h4/26 e.f.g.h1/26 >>>>---------------------------------------------------------------------- > > > I would assume what you will end up doing is > > iptables -t nat -A POSTROUTING -m mac-source <MACSERVER1> -j SNAT --to- > source <ALIAS1 of GW> > iptables -t nat -A POSTROUTING -m mac-source <MACSERVER2> -j SNAT --to- > source <ALIAS2 of GW> > > Where ALIAS1 and ALIAS2 are the IP''s of server 1 and server 2 aliased on > the firewall > > Regards > Shane > > On Tue, 2005-10-25 at 14:58 +0200, Daniel Frederiksen wrote: > >>Oscar Mechanic wrote: >> >>>Maybe I have missed somthing and you need to do it in POSTROUTING but >>>how about SNAT. >>> >> >>Well currently I do not NAT at all. I have ip_forwarding enabled and >>have assigned the first IP from the external block on the inside of the >>Gateway/Firewall. On the outside of the Gateway/Firewall I have assigned >>the WAN IP. This way when a system on the DMZ establishes a connection >>it is forwarded through the Gateway. >> >>Any suggestions to changes are appreciated. >> >>/Daniel.. >> >> >>>PS: ip can do stateless nat. >>> >>>On Tue, 2005- >>>10-25 at 14:36 +0200, Daniel Frederiksen wrote: >>> >>> >>>>Hello folks.. >>>> >>>>Does any of you know if it is possible to rewrite the ip src in a packet. >>>>I have a problem involving a DMZ with external IP addresses routed >>>>trough a single WAN IP. When the server initiates a connection, it looks >>>>like it comes from the WAN ip instead of it''s designated External IP >>>>routed through the WAN. >>>>So in short, Is it possible to rewrite the packet in the router, with >>>>Iptables, to make it look like it comes from the external IP address >>>>instead of the WAN IP of the router/firewall. >>>> >>>>Thank you very much for your time, I appreciate it. >>>> >>>>/Daniel Frederiksen >>>> >>>> >>>>NB: Small diagram of the setup. >>>> >>>> DMZ GW/FW ISP/Internet >>>>----------------------------------------------------------------------- >>>> Server #1 --| >>>> e.f.g.h3/26 | >>>> |---- Gateway/Firewall --- ISP WAN IP: a.b.c.d/30 >>>> Server #2 --| a.b.c.d1/30 Ext. IP: e.f.g.h/26 >>>> e.f.g.h4/26 e.f.g.h1/26 >>>>---------------------------------------------------------------------- >>>> >>>>_______________________________________________ >>>>LARTC mailing list >>>>LARTC@mailman.ds9a.nl >>>>http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc >>> >>> >> >>_______________________________________________ >>LARTC mailing list >>LARTC@mailman.ds9a.nl >>http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc > >
On Tuesday 2005-October-25 17:03, Daniel Frederiksen wrote:> Well, yes my ISP has assigned me the two "classes", however the > a.b.c.d/30 is a single IP through which the e.f.g.h/26 are routed > through. The ISP is not routing the e.f.g.h/26 directly to the line, > but through the single WAN IP a.b.c.e/30.. > This is why all traffic going through is touched and marked as coming > from the WAN instead of the External IP address.What you describe sounds like NAT. Your gateway should be forwarding that traffic with the source IP unchanged. Can you show us tcpdump or iptables -j LOG of some of these packets'' source IP being changed? I think we are missing part of the picture here. iptables-save; ip r l; ip ru l; ip a l # all those might help. Munge consistently if you feel compelled to munge.> >>>>NB: Small diagram of the setup. > >>>> > >>>> DMZ GW/FW ISP/Internet > >>>>----------------------------------------------------------------- > >>>>------ Server #1 --| > >>>> e.f.g.h3/26 | > >>>> > >>>> |---- Gateway/Firewall --- ISP WAN IP: a.b.c.d/30 > >>>> > >>>> Server #2 --| a.b.c.d1/30 Ext. IP: e.f.g.h/26 > >>>> e.f.g.h4/26 e.f.g.h1/26"DMZ" implies there is a separate subnet, and perhaps a SNAT''ed LAN, correct? You have 3 interfaces: internal, DMZ and external? Whether or not there is an internal doesn''t directly affect this, but anyway, that is how I would set it up. Your DMZ machines should have e.f.g.h1 as their default gateway. Your router machine should have whatever the ISP told you to use as its default gateway (probably a.b.c.d2, I bet.) -- mail to this address is discarded unless "/dev/rob0" or "not-spam" is in Subject: header
/dev/rob0 wrote:> On Tuesday 2005-October-25 17:03, Daniel Frederiksen wrote: > >>Well, yes my ISP has assigned me the two "classes", however the >>a.b.c.d/30 is a single IP through which the e.f.g.h/26 are routed >>through. The ISP is not routing the e.f.g.h/26 directly to the line, >>but through the single WAN IP a.b.c.e/30.. >>This is why all traffic going through is touched and marked as coming >>from the WAN instead of the External IP address. > > > What you describe sounds like NAT. Your gateway should be forwarding > that traffic with the source IP unchanged. Can you show us tcpdump or > iptables -j LOG of some of these packets'' source IP being changed?I would like to supply some tcpdump data, but at the moment the amount of data flowing through is massive and extends to 118 systems. I was actually trying to simplify the scenario a little bit. The thing is I also have multiple lines with the same config running through the gateway/firewall as a multipath routed setup. Ok here goes, I''ll try to define the complete setup: eth0 (WAN 1) IP: 80.16x.xxx.70/30 eth1 (WAN 2) IP: 80.16y.yyy.174/30 eth2 (Routed WAN 2 Class) IP: 80.16z.zzz.65/26 eth3 (Routed WAN 1 Class) IP: 62.24w.www.1/26 eth4 IP: 192.168.1.1/24 :~# ip ru 0: from all lookup local 32761: from 80.16x.xxx.70 lookup WAN1 32762: from 62.24w.www.0/26 lookup WAN1 32763: from 80.16z.zzz.64/26 lookup WAN2 32764: from 80.16y.yyy.174 lookup WAN2 32766: from all lookup main 32767: from all lookup default :~# ip r 80.16y.yyy.172/30 dev eth1 proto kernel scope link src 80.16y.yyy.174 80.16x.xxx.68/30 dev eth0 proto kernel scope link src 80.16x.xxx.70 80.16z.zzz.64/26 dev eth2 proto kernel scope link src 80.16z.zzz.65 62.24w.www.0/26 dev eth3 proto kernel scope link src 62.24w.www.1 192.168.1.0/24 dev eth4 proto kernel scope link src 192.168.1.1 default via 80.16x.xxx.69 dev eth0 The only other settings are: echo "1" > /proc/sys/net/ipv4/ip_forward iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to 80.16x.xxx.70 D''ooohhhh (Slaps his forehead).. Just found the problem.. Missing a "-s 192.168.1.0/24" in the above statement, to exclude everything except the LAN.. No wonder everything got nat''ed.. Well, I guess I''m buying the next round.. Anyway, thanks allot guys. You made my day and night.. /Daniel.> > I think we are missing part of the picture here. iptables-save; ip r l; > ip ru l; ip a l # all those might help. Munge consistently if you feel > compelled to munge. > > >>>>>>NB: Small diagram of the setup. >>>>>> >>>>>> DMZ GW/FW ISP/Internet >>>>>>----------------------------------------------------------------- >>>>>>------ Server #1 --| >>>>>> e.f.g.h3/26 | >>>>>> >>>>>> |---- Gateway/Firewall --- ISP WAN IP: a.b.c.d/30 >>>>>> >>>>>> Server #2 --| a.b.c.d1/30 Ext. IP: e.f.g.h/26 >>>>>> e.f.g.h4/26 e.f.g.h1/26 > > > "DMZ" implies there is a separate subnet, and perhaps a SNAT''ed LAN, > correct? You have 3 interfaces: internal, DMZ and external? Whether or > not there is an internal doesn''t directly affect this, but anyway, that > is how I would set it up. > > Your DMZ machines should have e.f.g.h1 as their default gateway. Your > router machine should have whatever the ISP told you to use as its > default gateway (probably a.b.c.d2, I bet.)
Possibly Parallel Threads
- Help Samba Virtual Servers (Host aliases) configuration problem
- Samba AD with internal DNS: Can't resolve aliases anymore
- Hybrid mode (SAMBA digest 1952)
- lda: vacation auto-reply for a virtual address
- [PATCH] builder: support aliases for images (RHBZ#1098718).