Is this possible?
Hi.
I'll do my best to explain what I'm trying to acheive with a linux box and 3 NICS.
I have two sets of systems. Each system has about 30 IP addresses spread across various bits of hardware. The two systems are identical (ie have the same 30 IP addresses). The addresses are all part of the class C subnet 192.168.0.*
The IP addresses for each system are now set in stone and can't be changed. Furthermore, similar addresses are already in use on our network.
I've been given a set of IP addresses I CAN use (172.26.158.*)
A diagram might help here ...
----------- -----------------
- System1 ---------|eth1 |
----------- | |
| Linux Router |
| eth0|------------Rest of the network
| |
----------- | |
- System2 ---------|eth2 |
----------- ------------------I also have an address I can use for eth0 which will make the router visible from machines on the rest of the network. This can be set as the default gateway for connections to the 172.26.158.* subnet.
I would like PCs on the normal network to be able to connect with either system by addressing them with addresses off the 172.26.158 subnet. I'll assign 30 of these IPs to each system.
For example. 172.26.158.10 might be mapped onto 192.168.0.2 on eth1 whilst 172.26.158.50 might be mapped onto 192.168.0.2 on eth2
Is this at all possible? I assume I'll need to use at least DNAT but also apply some other trickery to route to the correct interface. As a newbie to IPTables, I'm not sure how I might even begin to set up rules for this.
Hopefully this is the sort of thing people want to do all the time and it will be easy :)
Any help would be very much appreciated.
Thanks,
Al
This email and any attachments are confidential to the intended recipient and may also be privileged. If you are not the intended recipient please delete it from your system and notify Thales Underwater Systems on +44 1963 370 551. You should not copy it or use it for any purpose nor disclose or distribute its contents to any other person.
--- Fisher Alex <[email protected]>
Quoted 3 lines · wrote:
I'll do my best to explain what I'm trying to
acheive with a linux box
and 3 NICS.
I'll do my best too. :D
Quoted 48 lines
I have two sets of systems. Each system has about 30 IP addresses
spread across various bits of hardware. The two systems are identical
(ie have the same 30 IP addresses). The addresses are all part of the
class C subnet 192.168.0.*The IP addresses for each system are now set in stone and can't be
changed. Furthermore, similar addresses are already in use on our network.I've been given a set of IP addresses I CAN use
(172.26.158.*)A diagram might help here ...
----------- ----------------- - System1 ---------|eth1 | ----------- | | | Linux Router | | eth0|------------Rest of the network | | ----------- | | - System2 ---------|eth2 | ----------- ------------------I also have an address I can use for eth0 which will make the router
visible from machines on the rest of the network. This can be set as
the default gateway for connections to the 172.26.158.* subnet.I would like PCs on the normal network to be able to connect with either
system by addressing them with addresses off the 172.26.158 subnet.
I'll assign 30 of these IPs to each system.For example. 172.26.158.10 might be mapped onto
192.168.0.2 on eth1
whilst 172.26.158.50 might be mapped onto
192.168.0.2 on eth2
Quoted 7 lines
Is this at all possible? I assume I'll need to use at least DNAT but
also apply some other trickery to route to the correct interface. As a
newbie to IPTables, I'm not sure how I might even begin to set up rules
for this.
I guess what you basically need to do is DNAT, as
you got it. In addition you also need a way to distinguish packets to the two subnets. Since at eth2, by the IP you know where that packet is destined, you could use the MARK target to mark the packets appropriately. Later on, you could use this mark and appropriately force route the packets to the appropriate interfaces using the ROUTE target.
I guess this should work, though I may be totally
wrong.. being pretty new to iptables myself.
Quoted 6 lines
Hopefully this is the sort of thing people want to do all the time and
it will be easy :)Any help would be very much appreciated.
=====
Regards,
Kiran Kumar Immidi
__________________________________
Do you Yahoo!?
Yahoo! Photos: High-quality 4x6 digital prints for 25¢
http://photos.yahoo.com/ph/print_splash
Quoted 17 lines · Fisher Alex
Hi.
I'll do my best to explain what I'm trying to acheive with a linux box and 3 NICS.
I have two sets of systems. Each system has about 30 IP addresses spread across various bits of hardware. The two systems are identical (ie have the same 30 IP addresses). The addresses are all part of the class C subnet 192.168.0.*
The IP addresses for each system are now set in stone and can't be changed. Furthermore, similar addresses are already in use on our network.
I would like PCs on the normal network to be able to connect with either system by addressing them with addresses off the 172.26.158 subnet. I'll assign 30 of these IPs to each system.
Quoted 7 lines
For example. 172.26.158.10 might be mapped onto 192.168.0.2 on eth1 whilst 172.26.158.50 might be mapped onto 192.168.0.2 on eth2
Is this at all possible? I assume I'll need to use at least DNAT but also apply some other trickery to route to the correct interface. As a newbie to IPTables, I'm not sure how I might even begin to set up rules for this.
This is not really a netfilter question - sure, you need to use DNAT, but once your routing (to get to the correct destination system) is working, the netfilter bit is simple.
I cannot resist challenging your statement "The IP addresses for each system are now set in stone and can't be changed", since setting up sensibly separate subnets with independent network addresses would be the "correct" solution to this problem.
However, if someone is adamant that you need to set up network connectivity between machines with such an unfriendly combination of IP addresses, I suggest you simply set up multiple host-specific routes on the netflter machine, telling it where to find each different 192.168.0.* destination address, and don't have a standard 192.168.0.0/24 route on that system.
Therefore, set up the routing so that the firewall machine can find each required destination IP, and then netfilter will go on top without a problem.
Regards,
Antony.
Signature · 7 lines
How I want a drink, alcoholic of course, after the heavy chapters involving
quantum mechanics.
- 3.14159265358979
Please reply to the list;
please don't CC me.Quoted 11 lines · Antony Stone
Quoted 4 lines · Fisher Alex
I have two sets of systems. Each system has about 30 IP addresses spread across various bits of hardware. The two systems are identical (ie have the same 30 IP addresses). The addresses are all part of the class C subnet 192.168.0.*
However, if someone is adamant that you need to set up network connectivity between machines with such an unfriendly combination of IP addresses, I suggest you simply set up multiple host-specific routes on the netflter machine, telling it where to find each different 192.168.0.* destination address, and don't have a standard 192.168.0.0/24 route on that system.
From what I understand of the question both system 1 and system 2 have the same pool of 192.168.x.x addresses, such as in a failover setup. Surely then this still would not work, as each would have two host-specific routes and the kernel chooses the first one it gets to in the routing table. That's not a netfilter issue though, it's a routing one and what to do would depend on whether you want fail over, load balancing across the two systems, etc. Whether or not that's the right way to go about doing it, I don't know.
David
Quoted 14 lines · David Cannings
Quoted 6 lines · Antony Stone
Quoted 4 lines · Fisher Alex
I have two sets of systems. Each system has about 30 IP addresses spread across various bits of hardware. The two systems are identical (ie have the same 30 IP addresses). The addresses are all part of the class C subnet 192.168.0.*
Quoted 6 lines
However, if someone is adamant that you need to set up network connectivity between machines with such an unfriendly combination of IP addresses, I suggest you simply set up multiple host-specific routes on the netflter machine, telling it where to find each different 192.168.0.* destination address, and don't have a standard 192.168.0.0/24 route on that system.
Quoted 5 lines
From what I understand of the question both system 1 and system 2 have the same pool of 192.168.x.x addresses, such as in a failover setup. Surely then this still would not work, as each would have two host-specific routes and the kernel chooses the first one it gets to in the routing table.
Hm, yes, on closer reading of Alex's specification, I think you might be right, in which case simple routing is not what he needs. (Indeed, Alex's latest posting which I've just seen confirms this).
I suspect something along the lines of the Linux Virtual Server is more appropriate. http://www.linuxvirtualserver.org
However, the fact that *both* sets of backend systems are using exactly the same IP addresses is still going to remain a horrible problem.
Quoted 4 lines
That's not a netfilter issue though, it's a routing one and what to do would depend on whether you want fail over, load balancing across the two systems, etc. Whether or not that's the right way to go about doing it, I don't know.
I think you're right on all counts here:
1. It's not a netfilter problem
2. whether failover or loadbalancing is required makes a difference to the solution
3. whether this is the right way to go about it is questionable
Regards,
Antony.
Signature · 9 lines
Programming is a Dark Art, and it will always be. The programmer is
fighting against the two most destructive forces in the universe:
entropy and human stupidity. They're not things you can always
overcome with a "methodology" or on a schedule.
- Damian Conway, Perl God
Please reply to the list;
please don't CC me.Quoted 31 lines
Hi.
I'll do my best to explain what I'm trying to acheive with a linux box and 3 NICS.
I have two sets of systems. Each system has about 30 IP addresses spread across various bits of hardware. The two systems are identical (ie have the same 30 IP addresses). The addresses are all part of the class C subnet 192.168.0.*
The IP addresses for each system are now set in stone and can't be changed. Furthermore, similar addresses are already in use on our network.
I've been given a set of IP addresses I CAN use (172.26.158.*)
A diagram might help here ...
----------- ----------------- - System1 ---------|eth1 | ----------- | | | Linux Router | | eth0|------------Rest of the network | | ----------- | | - System2 ---------|eth2 | ----------- ------------------I also have an address I can use for eth0 which will make the router visible from machines on the rest of the network. This can be set as the default gateway for connections to the 172.26.158.* subnet.
Quoted 7 lines
I would like PCs on the normal network to be able to connect with either system by addressing them with addresses off the 172.26.158 subnet. I'll assign 30 of these IPs to each system.
For example. 172.26.158.10 might be mapped onto 192.168.0.2 on eth1 whilst 172.26.158.50 might be mapped onto 192.168.0.2 on eth2
I've always regarded netfilter as a symmetric thing, so is it possible to
1. apply a set of S/DNAT rules specifically to
eth1 to map system1's 192 addresses to something else,
2. add a route to enable these new addresses to reach eth0
3. add appropriate rules to the FORWARD chain for those NAT'd addresses if required
4. add a suitable set of S/DNAT rules specifically for eth0 to S/DNAT those new addresses to a unique subset of 172 addresses
5. Do the same stuff for eth2 but 1. would not be necessary
Cheers,
Terry.