NATed and direct connection to one server
Hey everybody,
I just took over administering a LAN at a university site and I have to move an entire subnet from private to regular IPs. Up until now the only outside access to this net was a pop and an smtp server both of which the users accessed through the firewall's _IP_ address (there was no DNS entry). There were two NAT rules that forwarded the ports to the real servers.
To make the move as painless as possible for the users I want to keep the DNAT rules for a while (and point them to the new IP of the mail servers). I also added DNS entries for the real IPs of the mail servers. In the long run I want to drop NAT altogether but for now the mail servers should be reachable via both the firewall and their own addresses. Because I doubt everybody will immediately change their mail client'ss settings.
Now for my question: Do I need to add an SNAT rule in POSTROUTING to handle responses from the mail servers or is it enough to have the DNAT rules in PREROUTING? And if I indeed need an SNAT rule how can I possibly distinguish packets that belong to connections that were DNATed when they came in and those that weren't and had the right destination IP all along?
I feel like I'm making a simple thing very complicated here... but I only have limited experience with iptables. So any help is greatly appreciated.
Thanks,
Ben
Quoted 5 lines · Ben Goedeke
To make the move as painless as possible for the users I want to keep the DNAT rules for a while (and point them to the new IP of the mail servers).
Now for my question: Do I need to add an SNAT rule in POSTROUTING to
No.
Quoted 2 lines
handle responses from the mail servers or is it enough to have the DNAT rules in PREROUTING?
Yes.
Quoted 4 lines
And if I indeed need an SNAT rule how can I
possibly distinguish packets that belong to connections that were DNATed when they came in and those that weren't and had the right destination IP all along?
No problem (see above).
Regards,
Antony.
Signature · 5 lines
What makes you think I know what I'm talking about?
I just have more O'Reilly books than most people.
Please reply to the list;
please don't CC me.Ok, thanks Antony.
It's been bugging me for a few days now cause I just couldn't imagine the software being "intelligent" enough to make this so easy.
Quoted 4 lines · Ben Goedeke
Ok, thanks Antony.
It's been bugging me for a few days now cause I just couldn't imagine the software being "intelligent" enough to make this so easy.
netfilter remembers the packets which it translates on the way out (source + destination IP address, source + destination port (if TCP or UDP)), and looks for packets coming back which match the other way round (source vs. destination).
When it sees such matching packets, it knows they must be replies to previously translated ones, so it automagically applies the reverse
translation on the way back in. Any packets which don't match ones
previously sent, don't get automagically translated.
Antony.
Signature · 7 lines
How I want a drink, alcoholic of course, after the heavy chapters involving
quantum mechanics.
- 3.14159265358979
Please reply to the list;
please don't CC me.