Hi folks! I have a little problem here, probably not related to LAR and surely not to TC, but I don''t know somebody else to ask. The scenario is as follows: Router R has two connections to the internet (ippp3, static IP-Address with and a /29er network N1 routed to, and ppp0, dynamic IP-Address), one to the local network N2 (eth0). Currently, R does the following: - masqerades all connections from N2 to the Internet - policy-routes packets originating from connections from ippp3 back to ippp3 - firewalls Now I''d like to give a Host H1 in N2 a local, private IP-Address _and_ a public, non-private IP-Address from our /29-net. How would I do the routing? I tried routing the /29-net through eth0, which lets me ping R to H1, but not vice-versa. The routing from the internet to H1 and vice-versa also didn''t work. I allowed nearly everything to and from the /29-net in all of the input, forward and output-chains (I''m currently using Linux 2.2.20). Any help would be really appreciated. Please Cc'' me on answers, cause I''m getting the list only in digest-mode. -- Lukas
Lucky, If I understand correctly what you are trying to do, it is simple static network address translation. The following commands should give you static NAT. Choose an IP in your /29 and make it the public IP. Choose an IP in the internal rfc 1918 network and make it the private IP. Now try the following: ip route add nat pu.bl.ic.ip via pr.iv.at.ip ip rule add nat pu.bl.ic.ip from pr.iv.at.ip prio $PRIO ip route flush cache As for the packet filtering, you''ll have to make a second set of rules. You''ll need to allow the packet from outside to the public IP and you''ll need to add a second set of rules to allow the packet from outside to the private IP. Good luck, -Martin On Mon, 15 Jul 2002, Lucky wrote: : Hi folks! : : I have a little problem here, probably not related to LAR and surely not to : TC, but I don''t know somebody else to ask. : : The scenario is as follows: : : Router R has two connections to the internet (ippp3, static IP-Address with : and a /29er network N1 routed to, and ppp0, dynamic IP-Address), one to the : local network N2 (eth0). : Currently, R does the following: : : - masqerades all connections from N2 to the Internet : - policy-routes packets originating from connections from ippp3 back to ippp3 : - firewalls : : Now I''d like to give a Host H1 in N2 a local, private IP-Address _and_ a : public, non-private IP-Address from our /29-net. : : How would I do the routing? : I tried routing the /29-net through eth0, which lets me ping R to H1, but not : vice-versa. The routing from the internet to H1 and vice-versa also didn''t : work. : I allowed nearly everything to and from the /29-net in all of the input, : forward and output-chains (I''m currently using Linux 2.2.20). : : Any help would be really appreciated. : : Please Cc'' me on answers, cause I''m getting the list only in digest-mode. : : -- Martin A. Brown --- SecurePipe, Inc. --- mabrown@securepipe.com
Am Mit, 2002-07-17 um 00.37 schrieb lartc-request@mailman.ds9a.nl:> From: Martin A. Brown <mabrown-lartc@securepipe.com> > To: Lucky <lucky@knup.de> > Cc: lartc@mailman.ds9a.nl > Subject: Re: [LARTC] Routing private and non-private ips > Date: 16 Jul 2002 13:19:19 -0500 > > Lucky, > > If I understand correctly what you are trying to do, it is simple static > network address translation. The following commands should give you > static NAT.Well, that sounds quite good :) I first got an "RTNETLINK answers: Invalid argument", but D''oh, it was the wrong shell ;)> Choose an IP in your /29 and make it the public IP. Choose an IP in the > internal rfc 1918 network and make it the private IP. Now try the > following: > > ip route add nat pu.bl.ic.ip via pr.iv.at.ip > ip rule add nat pu.bl.ic.ip from pr.iv.at.ip prio $PRIO > ip route flush cacheA big thant you, this works so far. I thought that I could give a public IP to one of the NICs in the Server here, an it would be routed directly to, but this is also very nice. I think it works partially now. If I do a traceroute from a pc on the internet, it goes on up to the router and stops there. If I ping the NATed IP from the router, I get: moria2:~# ping x.x.x.42 ping: sendto: Invalid argument ping: wrote x.x.x.42 64 chars, ret=-1 Ping to the private one just works fine: moria2:~# ping 192.168.2.206 PING 192.168.2.206 (192.168.2.206): 56 data bytes 64 bytes from 192.168.2.206: icmp_seq=0 ttl=64 time=0.5 ms Well, there comes something to my mind: All of the 192.168.2.0/24 gets masq''ed to the internet on the router. I think I somehow have to exclude 192.168.2.206 (the pr.iv.at.ip) from the masq''ing, right? Or is the best solution to put the to-be-NATed server in another subnet (192.168.4.0/24) for example?> As for the packet filtering, you''ll have to make a second set of rules. > > You''ll need to allow the packet from outside to the public IP and you''ll > need to add a second set of rules to allow the packet from outside to the > private IP. > > Good luck, > > -Martin >-- Lucky
Lucky, : Well, there comes something to my mind: All of the 192.168.2.0/24 gets : masq''ed to the internet on the router. I think I somehow have to exclude : 192.168.2.206 (the pr.iv.at.ip) from the masq''ing, right? : Or is the best solution to put the to-be-NATed server in another subnet : (192.168.4.0/24) for example? Perhaps you could insert a new rule with ipchains or iptables. So, you have something in your chains rules that looks like this: ipchains -A forward -s 192.168.2.0/24 -d 0/0 -j MASQ Simply insert a special case: ipchains -I forward 1 -s 192.168.2.206 -d 0/0 -j ACCEPT Then the packet will not be masqueraded and will be handled by whatever other packet mangling rules you have (in particular, it will be NAT''d by the rule policy database). To verify that the RPDB has the rules you inserted, try this (your output should look similar to this; filled in with the correct pu.bl.ic.ip, of course): # ip rule show 0: from all lookup local 32765: from 192.168.2.206 lookup main map-to pu.bl.ic.ip 32766: from all lookup main 32767: from all lookup 253 # ip route show table all | grep nat nat pu.bl.ic.ip via 192.168.2.206 table local scope host Rules in both iptables and ipchains are handled sequentially, so you want to create the more specific chains rules first and then the more general. This prevents the general rule from matching before the specific rule is used. Freundliche grĂ¼sse, -Martin -- Martin A. Brown --- SecurePipe, Inc. --- mabrown@securepipe.com
Am Mit, 2002-07-17 um 19.18 schrieb Martin A. Brown:> Lucky,> So, you have something in your chains rules that looks like this: > ipchains -A forward -s 192.168.2.0/24 -d 0/0 -j MASQ > Simply insert a special case: > ipchains -I forward 1 -s 192.168.2.206 -d 0/0 -j ACCEPTOK, now I have in the firewall: Chain input (policy DENY): target prot opt source destination ports [ipac and lo rules] ACCEPT all ------ 0.0.0.0/0 pu.bl.ic.ip n/a [rest] Chain forward (policy DENY): target prot opt source destination ports ACCEPT all ------ 0.0.0.0/0 192.168.2.206 n/a ACCEPT all ------ 192.168.2.206 0.0.0.0/0 n/a [masq`ing stuff] Chain output (policy DENY): target prot opt source destination ports [ipac] ACCEPT all ------ 0.0.0.0/0 0.0.0.0/0 n/a ACCEPT all ------ 192.168.2.206 0.0.0.0/0 n/a [rest] and the routing is as follows: moria2:/etc/ipmasq/rules# ip rule ls 0: from all lookup local 320: from 192.168.2.206 lookup public.ip 32763: from is.dn.if.ip lookup isdn 32766: from all lookup main 32767: from all lookup default moria2:/etc/ipmasq/rules# ip route show table public.ip nat pu.bl.ic.ip via 192.168.2.206 scope host default dev ippp3 scope link moria2:/etc/ipmasq/rules# ip route show table isdn default via is.dn.peer.ip dev ippp3 I have a problem with the public.ip-table: normally, like in the lartc-howto, one does ip route add default via is.dn.peer.ip dev ippp3 table public.ip this actually works for table isdn (right after dial-up), but when I do this for table public.ip I get: RTNETLINK answers: Network is unreachable The ISDN-Peer is in another subnet (x.x.32.121) than our address-space (x.x.35.40/29), maybe that does matter. I hope somebody can help me there. If not, I''m just going on and try things out :) Maybe it is a Kernel-Problem, or such. I''m using 2.2.20, perhaps I have to use the lates 2.4? -- Lucky _______________________________________________ LARTC mailing list / LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/