Hello, On my systems i use shorewall 3.2.6. Now all systems where replace by new ones with new ip''s. So i tried with DNAT to map the old ip''s to the new one as long as DNS is updated. But i didn''t get it work. I see in tcpdump that a connect from client-ip to new-server-ip is done while connection the old on. But i get no response. Did i configure something in the masq file? Can you give some hints if this is possible and how? Best rEMa eg. 2.2.2.2 -> New IP 1.1.1.1 -> Old IP /etc/shorewall/rules Web/DNAT- net net:2.2.2.2 - - - 1.1.1.1 generates a log line while connection 1.1.1.1 from client Jan 20 21:00:26 EUL0300416 kernel: Shorewall:filter:FORWARD:IN=eth2 OUT=eth2 SRC=84.185.86.5 DST=2.2.2.2 LEN=52 TOS=0x00 PREC=0x00 TTL=117 ID=25634 DF PROTO=TCP SPT=1812 DPT=80 WINDOW=65535 RES=0x00 SYN URGP=0 Jan 20 21:00:26 EUL0300416 kernel: Shorewall:mangle:POSTROUTING:IN= OUT=eth2 SRC=84.185.86.5 DST=2.2.2.2 LEN=52 TOS=0x00 PREC=0x00 TTL=117 ID=25634 DF PROTO=TCP SPT=1812 DPT=80 WINDOW=65535 RES=0x00 SYN URGP=0 ------------------------------------------------------------------------- This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2008. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
rEMa wrote:> Hello, > > On my systems i use shorewall 3.2.6. > Now all systems where replace by new ones with new ip''s. > > So i tried with DNAT to map the old ip''s to the new one as long as DNS is > updated. > But i didn''t get it work. > > I see in tcpdump that a connect from client-ip to new-server-ip is done > while connection the old on. > But i get no response. > > Did i configure something in the masq file? > Can you give some hints if this is possible and how? > > Best > rEMa > > eg. > > 2.2.2.2 -> New IP > 1.1.1.1 -> Old IP > > /etc/shorewall/rules > Web/DNAT- net net:2.2.2.2 - - - 1.1.1.1 > > generates a log line while connection 1.1.1.1 from client > Jan 20 21:00:26 EUL0300416 kernel: Shorewall:filter:FORWARD:IN=eth2 OUT=eth2 > SRC=84.185.86.5 DST=2.2.2.2 LEN=52 TOS=0x00 PREC=0x00 TTL=117 ID=25634 DF > PROTO=TCP SPT=1812 DPT=80 WINDOW=65535 RES=0x00 SYN URGP=0 > Jan 20 21:00:26 EUL0300416 kernel: Shorewall:mangle:POSTROUTING:IN= OUT=eth2 SRC=84.185.86.5 DST=2.2.2.2 LEN=52 TOS=0x00 PREC=0x00 TTL=117 ID=25634 DF PROTO=TCP SPT=1812 DPT=80 WINDOW=65535 RES=0x00 SYN URGP=03.2.6 is a bit old, and I''m not going to dig around for the info. This is a variation of faq2, just with a different zone. Off the top of my head, think you need "routeback" in interfaces and in masq: eth2 eth2 1.1.1.1 tcp 80 Hope it helps, Jerry ------------------------------------------------------------------------- This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2008. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
rEMa wrote:> Did i configure something in the masq file? > Can you give some hints if this is possible and how? >/etc/shorewall/masq: eth2 0.0.0.0/0 <some IP address on eth2> Note that all ''forwarded'' traffic will appear to the new servers to original from <some IP address on eth2> -Tom -- Tom Eastep \ Nothing is foolproof to a sufficiently talented fool Shoreline, \ http://shorewall.net Washington USA \ teastep@shorewall.net PGP Public Key \ https://lists.shorewall.net/teastep.pgp.key ------------------------------------------------------------------------- This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2008. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/