SNAT does not work
Hi @ all,
I'm using a internal ip-range, wherefor I need NAT to connecting to the internet..
My problem is, that this rule does not work. When I start a Perl-code at the www, witch shows me my ip-address, it showes me the IP-address of the external interface of the router/firewall. I can not find the problem. If I set no POSTROUTING rule, it is the same game...
Is it possible, that NAT is not activeted at my kernel. How can I test it?
Hier a snippet of my roules:
# Delete all Rules (not the standard policy)
iptables -F
# --> SET ALL INPUT FLAGS <--
iptables -P INPUT DROP # DROP all, if no rule matches iptables -A INPUT -i eth0 -j ACCEPT # Every request, from the internal interface is allowed iptables -A INPUT -s 141.12.0.0/16 -j ACCEPT # Every request, from the GMD-LAN is allowed
# --> SET ALL FORWARD FLAGS <--
iptables -P FORWARD DROP # DROP all, if no rule matches
iptables -A FORWARD -s 192.168.0.0/16 -j ACCEPT
iptables -A FORWARD -d 192.168.0.0/16 -m state --state ESTABLISHED,RELATED -j ACCEPT
# --> SET ALL OUTPUT FLAGS <--
iptables -P OUTPUT ACCEPT # ACCEPT all, if no rule matches
# --> MASQUARDING <--
iptables -A POSTROUTING -t nat -o eth1 -j SNAT --to-source 141.12.218.99
# 141.12.218.3 => 192.168.1.3 ==> MAIL.globit.com (DA-WEB01)
# ======================================================================== iptables -A PREROUTING -t nat -d 141.12.218.3 -j DNAT --to-destination 192.168.1.3
iptables -A FORWARD -p tcp -d 192.168.1.3/32 --dport 25 -j ACCEPT ## SMTP Port iptables -A FORWARD -p tcp -d 192.168.1.3/32 --dport 110 -j ACCEPT ## POP3 Port iptables -A FORWARD -p tcp -d 192.168.1.3/32 --dport 143 -j ACCEPT ## IMAP Port
Hope sameone can help me.
Thx and best regards
Uwe Eisner
Quoted 6 lines · Uwe Eisner
My problem is, that this rule does not work. When I start a Perl-code at the www, witch shows me my ip-address, it showes me the IP-address of the external interface of the router/firewall. I can not find the problem. If I set no POSTROUTING rule, it is the same game...
Is it possible, that NAT is not activeted at my kernel. How can I test it?
If that were true you would not be able to enter the "-t nat -j SNAT" rule - you would get an error message.
I cannot see an obvious problem with your rules. I suggest you put a LOG
rule at the end of your FORWARD chain and see what gets logged (just before it gets default DROPped).
Antony.
On Thursday 06 June 2002 2:27 pm, Uwe Eisner wrote:
Hi.
Having read your email again, I realise that I do not understand what problem you're having...
Quoted 2 lines
I'm using a internal ip-range, wherefor I need NAT to connecting to the internet..
Okay, yes - I understand that.
Quoted 3 lines
My problem is, that this rule does not work. When I start a Perl-code at the www, witch shows me my ip-address, it showes me the IP-address of the external interface of the router/firewall.
Surely that means that your address translation *is* working ?
1. If it were not, the remote web server would not be able to establish a connection.
2. The external address of the firewall is the address you would expect to be coming from when yu use the SNAT rule.
3. If you are running a Perl script, I assume that means that a TCP 3-way handshake has been completed, which means the web server has successfully been able to send packets back to your client.
Quoted 1 line
I can not find the problem.
What *is* the problem ?
Quoted 1 line
If I set no POSTROUTING rule, it is the same game...
I do not understand what you mean by this. Surely you do not mean that if
you remove the POSTROUTING rule, you can still connect to a remote web server and have a Perl script tell you your source address ???
Maybe you can explain a little more for me ?
Antony.
Quoted 17 lines · Antony Stone
On Thursday 06 June 2002 2:27 pm, Uwe Eisner wrote:
Hi.
Having read your email again, I realise that I do not understand what problem you're having...
Quoted 4 lines
I'm using a internal ip-range, wherefor I need NAT to connecting to the internet..
Okay, yes - I understand that.
Quoted 8 lines
Quoted 5 lines
My problem is, that this rule does not work. When I start a Perl-code at the www, witch shows me my ip-address, it showes me the IP-address of the external interface of the router/firewall.
Surely that means that your address translation *is* working ?
But why is the external ip-address from the firewall showen at the www? I specifyed the IP-address 141.12.218.99 not 141.12.129.9 (ext. Router-IP-Address)
Quoted 17 lines
1. If it were not, the remote web server would not be able to establish a connection.
2. The external address of the firewall is the address you would expect to be coming from when yu use the SNAT rule.
3. If you are running a Perl script, I assume that means that a TCP 3-way handshake has been completed, which means the web server has successfully been able to send packets back to your client.
Quoted 3 lines
I can not find the problem.
What *is* the problem ?
Quoted 6 lines
Quoted 3 lines
If I set no POSTROUTING rule, it is the same game...
I do not understand what you mean by this. Surely you do not mean that if you remove the POSTROUTING rule, you can still connect to a remote web server and have a Perl script tell you your source address ???
Yes, that is it! I removed every POSTROUTING rule, but I could still connect to the web.
Quoted 3 lines
Maybe you can explain a little more for me ?
Of cause. :-)
First I configured the Firewall, with a MASQUERADE rule, which shows the www the external ip-address of the router/firewall. I removed the statement from the configuration script and add the new role:
iptables -A POSTROUTING -t nat -s 192.168.0.0/16 -j SNAT --to-source
141.12.218.1
Afterwards I typed the flash command 'iptables -F'. Now ALL rules should be removed, souldn't it?
I started my configuration script with the new rule (see above), but nothing has changed.
First I tought, that iptables -F does not delete the POSTROUTING rules, so I did it by hand:
iptables -D POSROUTING -t nat -s 192.168.0.0/16 -j MASQUERADE.
The same procedure, as discribed above and nothing has changed.
My plan is, that our network showes to the www just 1 ip-address, namely 141.12.218.99 and not the router-ip-address 141.12.129.9
Hope that is more information for you.
Thx
Uwe Eisner
Quoted 5 lines
Antony.
Quoted 5 lines · Uwe Eisner
Quoted 1 line
Surely that means that your address translation *is* working ?
But why is the external ip-address from the firewall showen at the www? I specifyed the IP-address 141.12.218.99 not 141.12.129.9 (ext. Router-IP-Address)
Sorry - I did not realise from your original email that 141.12.218.99 was not the external address of your firewall.
Quoted 6 lines
Quoted 3 lines
I do not understand what you mean by this. Surely you do not mean that
if you remove the POSTROUTING rule, you can still connect to a remote web server and have a Perl script tell you your source address ???Yes, that is it! I removed every POSTROUTING rule, but I could still connect to the web.
In that case you must have Network Address Translation in operation on your
external router ? If not, then there is no way that:
a) privately-addressed machines 10.x.y.z, 172.16.s.t, 192.168.a.b could contact external servers
b) your router address would show up on an external machine.
Quoted 2 lines
Afterwards I typed the flash command 'iptables -F'. Now ALL rules should be removed, souldn't it?
No. Not unless you also typed
iptables -F -t nat
"iptables -F" on its own will *only* clear the filtering table, not the nat table or the mangle table.
Try iptables -L -t nat to see what rules you really have in place.
Quoted 4 lines
I started my configuration script with the new rule (see above), but nothing has changed.
First I tought, that iptables -F does not delete the POSTROUTING rules,
Correct :-)
Antony.
Hi Antony..
thx for your information! Now it works fine!
greatings
Uwe
Quoted 62 lines · Antony Stone
Quoted 8 lines · Uwe Eisner
Quoted 3 lines
Surely that means that your address translation *is* working ?
But why is the external ip-address from the firewall showen at the www? I specifyed the IP-address 141.12.218.99 not 141.12.129.9 (ext. Router-IP-Address)
Sorry - I did not realise from your original email that 141.12.218.99 was not the external address of your firewall.
Quoted 9 lines
Quoted 5 lines
I do not understand what you mean by this. Surely you do not mean that
if you remove the POSTROUTING rule, you can still connect to a remote web server and have a Perl script tell you your source address ???Yes, that is it! I removed every POSTROUTING rule, but I could still connect to the web.
In that case you must have Network Address Translation in operation on your external router ? If not, then there is no way that:
a) privately-addressed machines 10.x.y.z, 172.16.s.t, 192.168.a.b could contact external servers
b) your router address would show up on an external machine.
Quoted 4 lines
Afterwards I typed the flash command 'iptables -F'. Now ALL rules should be removed, souldn't it?
No. Not unless you also typed
iptables -F -t nat"iptables -F" on its own will *only* clear the filtering table, not the nat table or the mangle table.
Try iptables -L -t nat to see what rules you really have in place.
Quoted 6 lines
I started my configuration script with the new rule (see above), but nothing has changed.
First I tought, that iptables -F does not delete the POSTROUTING rules,
Correct :-)
Antony.