i have a box with 2 real interfaces and one more virtual
eth0 - to the internet (193....
eth1 - to the local net (192.168..)
tun0 - to another ISP
the routing is: all the free/local classes i send them directly on eth0,
the rest of the internet i send throw tun0
the admin from tun0 wants me to snat all the packets with my end of the
ip-tun0-interface
and i snat all the trafic that go to local/free nets
the problem is that on the tun0 i see packets with source adr my eth0
and dest somewhere in the internet, and are only acks (i also see nated
trafic), why????
ill start with some confs and at the end some descoveryes:
so a "ip rule" looks like:
0: from all lookup local
32516: from 192.168.40.0/24 lookup metro
32517: from 192.168.40.254 lookup tunel
32518: from 192.168.40.253 lookup tunel
..........
32765: from 192.168.40.2 lookup tunel
32766: from all lookup main
32767: from all lookup default
an ip route list table metro have entres like:
84...0/17 via 193. dev eth0
an ip route list table tunel its only a default
default via 10.0.1.1 dev tun0
an the main have the directed connected nets and a def throw eth0
the iptables looks:
filter - empty
mangle - mark trafic for the tc part
nat - only
Chain POSTROUTING
481 52825 SNAT all -- * tun0 192.168.40.0/24 0.0.0.0/0 to:10.0.1.2
0 0 SNAT all -- * eth0 192.168.40.100 0.0.0.0/0 to:IP_IF_ETH0
........................
a tcpdump on tun0 gets
tcpdump -i tun0 -n | grep -v 10.0.1.2
IP_IF_ETH0.8181 > 24.129.71.219.42694: ack 2449728106 win 33870 (DF)
IP_IF_ETH0.8181 > 24.129.71.219.42694: ack 1 win 33870 (DF)
IP_IF_ETH0.8181 > 81.208.36.95.9195: . ack 272319646 win 65225 (DF)
so i begin to put accounting/logging rules in iptables with -s
IP_IF_ETH0, i did in nat POSTROUTING, in filter OUTPUT,INPUT,FORWARD,
and i got on OUTPUT
Oct 10 04:10:39 kernel: IN= OUT=eth0 SRC=IP_IF_ETH0 DST=83.175.129.103
LEN=40 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=TCP SPT=8181 DPT=4894
WINDOW=0 RES=0x00 ACK RST URGP=0
so its a localgenerated packet that is marked to get out on eth0, but he
gets on tun0. I presumes (pls confirm) that the label of the interface
is put by the output_routing, and when he gets to the OUTPUT_conntrack
its marked to get out on tun0 but dont modify the label, so he dont
match my rule of snat -o tun0
how can i solve the problem, i dont see how, or its the config bad, or a
bug :-)))
C
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
