Static NATting

DISCUSSION Greg Dickinson 3 participants 3 messages Mar 18, 2003

Share & tools

Greg Dickinson

author

2003-03-18 17:48 UTC #0 lore raw

Hello all,

This question will undoubtedly get me branded as a n00b :-) but I am about to go insane trying to figure this out. Am I doing something wrong?

Here's the scenario:

I have a RedHat 8 (Kernel 2.4-18) firewall that I am going to run squid on, as well as do some static NATting for some of the administrative PC's here. I have configured the Cisco router to direct all the traffic from the affected /24 subnet to the linux box, and I am trying to do a 1-to-1 NAT so we can do things like Terminal Services, etc. across the internet. I am using the following commands (the addresses are for my PC)

iptables -t nat -A POSTROUTING -s 10.227.101.4 -j SNAT --to 207.157.9.<something> iptables -t nat -A PREROUTING -s 207.157.9.<something> -j DNAT --to 10.227.101.4

And all the traffic summarily dies at the firewall :-)

I have aliased the 207.157.9.<something> address to the eth1 interface of the firewall. What simple, obvious thing have I missed?

TIA,

--Greg

Gregory B. Dickinson, CNE CCNA
Systems Engineer
Logista Solutions
(205) 231-5602
(tQ = 2b|!2b)

BEGIN:VCARD
VERSION:2.1
X-GWTYPE:USER
FN:Dickinson, Greg
ORG:;Technical Services EMAIL;WORK;PREF;NGW:[email protected] N:Dickinson;Greg
END:VCARD

Steve Mickeler

2003-03-18 18:59 UTC #1 lore raw

Quoted 10 lines · Greg Dickinson

Hello all,
This question will undoubtedly get me branded as a n00b :-) but I am about to go insane trying to figure this out. Am I doing something wrong?
Here's the scenario:
I have a RedHat 8 (Kernel 2.4-18) firewall that I am going to run squid on, as well as do some static NATting for some of the administrative PC's here. I have configured the Cisco router to direct all the traffic from the affected /24 subnet to the linux box, and I am trying to do a 1-to-1 NAT so we can do things like Terminal Services, etc. across the internet. I am using the following commands (the addresses are for my PC)
iptables -t nat -A POSTROUTING -s 10.227.101.4 -j SNAT --to 207.157.9.<something> iptables -t nat -A PREROUTING -s 207.157.9.<something> -j DNAT --to 10.227.101.4

Change the -s to -d on the PREROUTING rule.

iptables -t nat -A PREROUTING -d 207.157.9.X -j DNAT --to 10.227.101.4 iptables -t nat -A POSTROUTING -s 10.227.101.4 -j SNAT --to 207.157.9.X

Quoted 18 lines

And all the traffic summarily dies at the firewall :-)
I have aliased the 207.157.9.<something> address to the eth1 interface of the firewall. What simple, obvious thing have I missed?
TIA,
--Greg
Gregory B. Dickinson, CNE CCNA
Systems Engineer
Logista Solutions
(205) 231-5602
(tQ = 2b|!2b)

Scott MacKay

2003-03-18 19:00 UTC #2 lore raw

Granularity of ipq_read timeout

In reply to Greg Dickinson

Hello all,
I was curious, is the granularity of the ipq_read() timeout field really down to the microsecond level?

I am running on linux (RH, but with the 2.4.20 kernel so I could patch for bridge + iptables) and seem to be having a problem with small timeout values.

If i use something like:

gettimeofday(&starttime,&null_tx); status=ipq_read(qh,buffer,BUFFER_SIZE,timeout); gettimeofday(&endtime,&null_tx);

I notice that my delta from the endtime-startime is larger than the timeout value. Can ipq_read() actually timeout on the single digit microsecond level?

-Scott

__________________________________________________
Do you Yahoo!?
Yahoo! Platinum - Watch CBS' NCAA March Madness, live on your desktop!
http://platinum.yahoo.com