Question regarding packet src/dst rewriting
Hello all,
I have a linux router over here with 4 ethernet nics running on 2.6.4 kernel. The respective IP's are as follows:
eth0 : peering point to ISP
eth1: public routable IP block (/23)
eth2 : 172.16.0.1
eth3 : 192.168.0.1
The weird behavior I am having is that whenever a packet from the Internet comes in interface eth0, and gets forwarded to a server on eth1, the server which resides on the eth1 side of the network sees the source IP as coming from the router and not the real host on the Internet. Vice versa applies as well (a node behind eth1 sends a packet out to, say, google.com. Google.com sees the data as coming from the router, and not the node which is behind eth1).
I dont understand why the packet headers are being re-written. I also dont understand if this is a specific problem with iptables, or the linux kernel itself.
eth2 and eth3 are masquerading, but eth1 is not.
Any help would be greatly appreciated.
Thanks again,
Russ
Quoted 8 lines · Russell Handorf
The weird behavior I am having is that whenever a packet from the Internet comes in interface eth0, and gets forwarded to a server on eth1, the server which resides on the eth1 side of the network sees the source IP as coming from the router and not the real host on the Internet. Vice versa applies as well (a node behind eth1 sends a packet out to, say, google.com. Google.com sees the data as coming from the router, and not the node which is behind eth1).
My assumption is that you are using a MASQUERADE rule regardless of the outgoing device.
Quoted 6 lines
I dont understand why the packet headers are being re-written. I also dont understand if this is a specific problem with iptables, or the linux kernel itself.
eth2 and eth3 are masquerading, but eth1 is not.
Okay, so you are using 2 MASQUERADE rules with specific outgoing device ? Please post your ruleset. PREROUTING and POSTROUTING chains should be enough.