IP redirect?
Hi Folks
To redirect lan traffic addressed to the wan IP (e.g.) 123.456.789.012 to the lan IP address 192.168.1.123, I'm using the following:
$ iptables -t nat -I PREROUTING 1 -d 123.456.789.012 -j DNAT --to-destination 192.168.1.123
But, all internal traffic seems to get lost - 18 months ago when I last did this, traffic to 123.456.789.012 seemed to hit 192.168.1.123 and come back without problem.
I've added the following, with some interesting results:
$ iptables -t nat -I POSTROUTING 1 -s 192.168.1.40 -j SNAT --to-source 58.28.20.69
Now, the traffic from the specific lan IP 192.168.1.123 does seem to be redirected correctly and come back to itself. But still, all other lan traffic seems to get lost.
Any ideas what's happening, where I'm getting lost?
Regards,
Morgan.
Signature · 14 lines
Getting errors: "There are problems with the signature" (or similar)? Update your system by installing certificates from CAcert Inc, see here: http://wiki.cacert.org/wiki/BrowserClients?#head-259758ec5ba51c5205cfb179cf60e0b54d9e378b Or, if Internet Explorer is your default browser, simply click this link: http://www.cacert.org/index.php?id=17 Morgan Read NEW ZEALAND <mailto:mstuffATreadDOTorgDOTnz> fedora & freedom; fact || fiction? http://fedoraproject.org/wiki/Overview get freed-ora! http://www.fsfla.org/svnwiki/selibre/linux-libre/freed-ora
Quoted 5 lines · Morgan Read
To redirect lan traffic addressed to the wan IP (e.g.) 123.456.789.012 to the lan IP address 192.168.1.123, I'm using the following:
$ iptables -t nat -I PREROUTING 1 -d 123.456.789.012 -j DNAT --to-destination 192.168.1.123But, all internal traffic seems to get lost - 18 months ago when I last did this, traffic to 123.456.789.012 seemed to hit 192.168.1.123 and come back without problem.
Please search the mailing list archives for the "TCP Triangle". The most recent thread was "routing all HTTP requests to my own web server".
Also, take a look at one of Julian's images
"http://jengelh.hopto.org/images/dnat-mistake.png" for more information.
Quoted 2 lines
I've added the following, with some interesting results:
$ iptables -t nat -I POSTROUTING 1 -s 192.168.1.40 -j SNAT --to-source 58.28.20.69
*nod*
Quoted 1 line
Now, the traffic from the specific lan IP 192.168.1.123 does seem to be redirected correctly and come back to itself. But still, all other lan traffic seems to get lost.
This is as I would expect.
Quoted 1 line
Any ideas what's happening, where I'm getting lost?
You are only SNATing traffic from (-s) 192.168.1.40. Try SNATing all traffic from your local LAN that is being redirected to your system.
$ iptables -t nat -I POSTROUTING 1 -s 192.168.1.0/24 -d 192.168.1.123 -j SNAT --to-source 58.28.20.69
Note: I'm not sure why you are using a source of 58.28.20.69. I would think that you would want to use the source of your internal interface in the 192.168.1.0/24 network.
Grant. . . .
Below:
Quoted 6 lines · Grant Taylor
Quoted 5 lines · Morgan Read
To redirect lan traffic addressed to the wan IP (e.g.) 123.456.789.012 to the lan IP address 192.168.1.123, I'm using the following:
$ iptables -t nat -I PREROUTING 1 -d 123.456.789.012 -j DNAT --to-destination 192.168.1.123
Quoted 8 lines
Quoted 3 lines
But, all internal traffic seems to get lost - 18 months ago when I last did this, traffic to 123.456.789.012 seemed to hit 192.168.1.123 and come back without problem.
Please search the mailing list archives for the "TCP Triangle". The most recent thread was "routing all HTTP requests to my own web server".
Also, take a look at one of Julian's images
"http://jengelh.hopto.org/images/dnat-mistake.png" for more information.
OK, thank you
Quoted 13 lines
Quoted 4 lines
I've added the following, with some interesting results:
$ iptables -t nat -I POSTROUTING 1 -s 192.168.1.40 -j SNAT --to-source 58.28.20.69*nod*
Quoted 3 lines
Now, the traffic from the specific lan IP 192.168.1.123 does seem to be redirected correctly and come back to itself. But still, all other lan traffic seems to get lost.
This is as I would expect.
Quoted 7 lines
Quoted 1 line
Any ideas what's happening, where I'm getting lost?
You are only SNATing traffic from (-s) 192.168.1.40. Try SNATing all traffic from your local LAN that is being redirected to your system.
$ iptables -t nat -I POSTROUTING 1 -s 192.168.1.0/24 -d 192.168.1.123 -j SNAT --to-source 58.28.20.69
Thank you, it works - any ideas why why the DNAT worked on it's own with out the SNAT 18 months ago? Or is that a silly question...
Many thanks,
M.
Signature · 14 lines
Getting errors: "There are problems with the signature" (or similar)? Update your system by installing certificates from CAcert Inc, see here: http://wiki.cacert.org/wiki/BrowserClients?#head-259758ec5ba51c5205cfb179cf60e0b54d9e378b Or, if Internet Explorer is your default browser, simply click this link: http://www.cacert.org/index.php?id=17 Morgan Read NEW ZEALAND <mailto:mstuffATreadDOTorgDOTnz> fedora & freedom; fact || fiction? http://fedoraproject.org/wiki/Overview get freed-ora! http://www.fsfla.org/svnwiki/selibre/linux-libre/freed-ora
Quoted 1 line · Morgan Read
OK, thank you
You are welcome.
Quoted 1 line
Thank you, it works - any ideas why why the DNAT worked on it's own with out the SNAT 18 months ago? Or is that a silly question...
No. I see no reason that it would have worked before at all. The only thing that I can think of is that you were not DNATing with in the same subnet such that your traffic was routed back through the router where it would unDNAT it any way, much like MASQUERADing / SNAT does out to the internet (remember that MASQUERADing / SNATing is only so that systems on the net have a route back to your client).
Quoted 1 line
Many thanks,
*nod*
Grant. . . .