Newbie request
Hi,
I am trying to setup an old machine having two NICs with Fedora Core 5. I have two Class C networks (I hope I got that right).
eth0 is assigned 192.168.1.6/255.255.255.0 .
eth1 is set to DHCP and is part of 192.168.0.0/24 .
I need some machines on 192.168.1.0/24 network to be able to get/send mail using 192.168.0.10 . Mail is limited to these networks and does not go to the outside world.
I have gone through the Linux-IP-Masquerade HOWTO and feel that I don't need a very liberal ruleset. Only smtp,pop functionality, especially connecting with 192.168.0.10 is sufficient.
My question is: Do I need a SNAT rule or should I try something with nat+FORWARD? I just went through iptables manual and am somewhat able to understand the rules in the HOWTO - stronger firewall example.
Thanks in advance,
Nandan Bhat
Quoted 13 lines · Nandan Bhat
Hi,
I am trying to setup an old machine having two NICs with Fedora Core 5. I have two Class C networks (I hope I got that right).
eth0 is assigned 192.168.1.6/255.255.255.0 . eth1 is set to DHCP and is part of 192.168.0.0/24 .I need some machines on 192.168.1.0/24 network to be able to get/send mail using 192.168.0.10 . Mail is limited to these networks and does not go to the outside world.
Quoted 7 lines
I have gone through the Linux-IP-Masquerade HOWTO and feel that I don't need a very liberal ruleset. Only smtp,pop functionality, especially connecting with 192.168.0.10 is sufficient.
My question is: Do I need a SNAT rule or should I try something with nat+FORWARD? I just went through iptables manual and am somewhat able to understand the rules in the HOWTO - stronger firewall example.
No. You can just route from 192.168.0.0/24 to 192.168.1.0/24 and back without using NAT.
You can filter packets you don't want to be routed.
$ipt -P FORWARD DROP
$ipt -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT $ipt -A FORWARD -m state --state NEW -s 192.168.0.0/24 \
-d 192.168.1.0/24 -m mport -p tcp --dports 25,110 -j ACCEPT
$ipt -A FORWARD -m state --state NEW -s 192.168.1.0/24 \
-d 192.168.0.0/24 -m mport -p tcp --dports 25,110 -j ACCEPT
The last 2 rules can also be split into 4 rules if you don't have the mport module :
$ipt -A FORWARD -m state --state NEW -s 192.168.0.0/24 \
-d 192.168.1.0/24 -p tcp --dport 25 -j ACCEPT
$ipt -A FORWARD -m state --state NEW -s 192.168.0.0/24 \
-d 192.168.1.0/24 -p tcp --dport 110 -j ACCEPT
$ipt -A FORWARD -m state --state NEW -s 192.168.1.0/24 \
-d 192.168.0.0/24 -p tcp --dport 25 -j ACCEPT
$ipt -A FORWARD -m state --state NEW -s 192.168.1.0/24 \
-d 192.168.0.0/24 -p tcp --dport 110 -j ACCEPT
Don't forget to:
echo 1 > /proc/sys/net/ipv4/ip_forward
Grts,
Rob
Hello,
Quoted 11 lines · Rob Sterenborg
Quoted 7 lines · Nandan Bhat
I need some machines on 192.168.1.0/24 network to be able to get/send mail using 192.168.0.10 . Mail is limited to these networks and does not go to the outside world.
My question is: Do I need a SNAT rule or should I try something with nat+FORWARD?
No. You can just route from 192.168.0.0/24 to 192.168.1.0/24 and back without using NAT.
But then you need that host 192.168.0.10 has a route back to 192.168.1.0/24, either directly via eth1 IP address (so it'd better be fixed), or indirectly via the default gateway which must have a route to 192.168.1.0/24 via eth1 IP address. Else you must do SNAT or MASQUERADE for 192.168.1.0/24 on eth1 :
iptables -t nat -A POSTROUTING -o eth1 -s 192.168.1.0/24 -j MASQUERADE
Quoted 7 lines
$ipt -A FORWARD -m state --state NEW -s 192.168.0.0/24 \
-d 192.168.1.0/24 -m mport -p tcp --dports 25,110 -j ACCEPT
$ipt -A FORWARD -m state --state NEW -s 192.168.1.0/24 \
-d 192.168.0.0/24 -m mport -p tcp --dports 25,110 -j ACCEPTThe last 2 rules can also be split into 4 rules if you don't have the mport module :
Or just use the more standard 'multiport' match instead.
Quoted 7 lines · Pascal Hambourg
Hello,
Rob Sterenborg a �crit :
Quoted 3 lines
Quoted 2 lines
My question is: Do I need a SNAT rule or should I try something with nat+FORWARD?
Quoted 8 lines
Quoted 2 lines
No. You can just route from 192.168.0.0/24 to 192.168.1.0/24 and back without using NAT.
But then you need that host 192.168.0.10 has a route back to 192.168.1.0/24, either directly via eth1 IP address (so it'd better be fixed), or indirectly via the default gateway which must have a route to 192.168.1.0/24 via eth1 IP address. Else you must do SNAT or MASQUERADE for 192.168.1.0/24 on eth1 :
Yes, I was assuming that the default gateway is set to the router's IP, but in fact we don't know about the connection to the internet which is there somewhere.
Quoted 10 lines
Quoted 8 lines
$ipt -A FORWARD -m state --state NEW -s 192.168.0.0/24 \
-d 192.168.1.0/24 -m mport -p tcp --dports 25,110 -j ACCEPT $ipt -A FORWARD -m state --state NEW -s 192.168.1.0/24 \
-d 192.168.0.0/24 -m mport -p tcp --dports 25,110 -j ACCEPTThe last 2 rules can also be split into 4 rules if you don't have the mport
module :Or just use the more standard 'multiport' match instead.
I keep getting confused with these two.. I thought it was mport but someday I'll remember.
Grts,
Rob
Quoted 3 lines · Rob Sterenborg
Yes, I was assuming that the default gateway is set to the router's IP, but in fact we don't know about the connection to the internet which is there somewhere.
No, we do not know about the gateway. However, recall from the OP that "eth1 is set to DHCP and is part of 192.168.0.0/24", which means that the route back to the 192.168.1.0/24 network could change as the ""router in question reboots. So, either the routers are running some sort of routing protocol, or the 192.168.1.0/24 network needs to be ""hidden from the 192.168.0.0/24 network. This is very easily accomplished with SNAT / MASQUERADE.
Something to keep in mind is that the source IP is a dynamic IP on the 192.168.0.0/24 network, so it would be better if MASQUERADE was used verses SNAT. SNAT does not clear out stale nat translations like MASQUERADE does when the IP for the interface changes.
Grant. . . .