LARTC - Jun 2005 - RE: Q: Routing the Same IP simultaneously on differentcomputers ?

Hi,

First, never compare a linux box with a cheap and dumb broadband router.

I''m not sure if i understand very well your scenario but I asume is
like
this:
						     192.168.0.1---------
					   	     -----------| ipsec |
	 	 	 	    		     |	    ---------
    128.X.X.X ---------	192.168.0.254    |
ISP ----------| linux |------------------|
		  ---------	    		     |	    ---------
	   		          		     -----------|  voip |
						     192.168.0.2---------


You should read the iptables manpage, and your questions would have been
already answered.

Anyway here we go ... 

The nat table has 2 targets, SNAT and DNAT.
SNAT alters source IP adresses and DNAT alters destination addreses.
Netfilter can alter more protocols than tcp or udp. It can alter
gre(protocol 57), used by  pptp vpn, or even ipsec esp(proto 50) or ah(proto
51).

How does it work ?! 
All packets pass through netfilter, you can google for a diagram, to see the
order of traversal trough the tables/chains. But this concerns only the nat
table so, the order is: PREROUTING, FORWARD, POSTROUTING.

In the PREROUTING chain, we can alter the destianion of the packet, so :

iptables -t nat -I PREROUTING -p 50 -d 128.x.x.x -j DNAT --to-destination
192.168.0.1

This will change the IPSEC ah packet''s destination address to your lan
ipsec
host.

I don''t know if this is really functional. I''m not so familiar
with ipsec
ah, but should work, as far as routing/nat is concerned.

As for the voip host. Let''s say it uses TCP 5060 and UDP 5060.
iptables -t nat -I PREROUTING -p tcp -d 128.x.x.x --dport 5060 -j DNAT
--to-destination 192.168.0.1
iptables -t nat -I PREROUTING -p udp -d 128.x.x.x --dport 5060 -j DNAT
--to-destination 192.168.0.1

In the POSTROUTING chain, we can alter the source of the packet so:

As i understood, you''ve gone past this but here is an example...
iptables -t nat -I POSTROUTING -s 192.168.0.1 -j SNAT --to-source 128.x.x.x

This changes the source destination of the packet after the routing has
taken place, so your private address is altered.


This should do the trick.


If you want to forward EVERYTHING to a host, the linux router cannot use the
internet itself (acts as a stupid broadband router). This means, the routing
works great, but the linux box itself can''t estabilish any connection,
since
packets destinated to it is forwarded to a lan host. And this is not what we
want. 

Success,
Iosif Peterfi,
S.C. Forte Systems SRL
http://wwww.fortesys.ro/

-----Original Message-----
From: lartc-bounces@mailman.ds9a.nl [mailto:lartc-bounces@mailman.ds9a.nl]
On Behalf Of John Wigley
Sent: Tuesday, June 21, 2005 7:41 PM
To: lartc@mailman.ds9a.nl
Subject: [LARTC] Q: Routing the Same IP simultaneously on differentcomputers
?

Hi,

I''ve asked this elsewhere and received hints but no one seems to have a
concrete explanation :-

What I am looking to do is to be able to configure a Linux based router to
be able to share THE SAME SINGLE Public IP address between the linux router 
and a
single computer on the lan acting as the DMZ host (NOT normal NAT IP sharing

!).

So basically you have a linux router with two network ports, WAN and LAN.
The router takes the single ISP assigned public IP address for it''s WAN
interface and then uses a non routable subnet for the LAN port. There are a
number of machines on the LAN segment and the linux router is performing NAT
for them so that they have internet connectivity - so far this is a standard
normal setup.

Now what I want to do is to simultaneously assign that SAME PUBLIC IP
address onto one of the LAN computers so that it for all intents and
purposes is a DMZ host.

Before anyone says that this is mad and that it can''t be done, it can
be
done perfectly well and all WESTELL ADSL / Ethernet routers have this
functionality along with some no name Far Eastern origin broadband routers
based on a Conexant OEM reference design.

Having thought long and hard about how to do this but not knowing  NetFilter
at all, I realised that the way this must be done is for the router to
perform a standard NAT function with the added functions of tracking all
outgoing connections from the DMZ host and entering those into the NAT table
as well, so that it doesn''t try to do a Port Address Translation on top
of
an existing outgoing connection from the DMZ host. For incoming connections,
if the incoming packet has a reference in the NAT table then it is directed
to the originating LAN machine and if not is passed through unmodified to
the DMZ host.

I have spent much time googling and reading list postings but cannot find
any reference on how to do this under linux, my guess is that Proxy ARP
needs to be enabled on the LAN interface and then a 1:1 POST NAT mapping set
to remap all the packets for the DMZ host back to the original public IP
address but after that I''m stuck.

This is an incredibly useful feature which I''ve used on the Westell
routers
for some time, but now want to move to a Linux based router to be able to do
QOS, as it allows all the benefits of NAT for sharing a single IP address
but also the benefits of a routed connection for NAT unaware applications
like IPSEC AH, and some VOIP implementations.

Any advice on setting this up would be much appreciated,

Thanks,

John Wigley


_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc



-- 
This message was scanned for spam and viruses by BitDefender.
For more information please visit http://linux.bitdefender.com/