Send local traffic to a different server.
I've tried a number of different PREROUTING and POSTROUTING rules and can't seem to make this work.
I have a system with a single nic (eth0). While I'm on the system via a shell I would like to connect to 127.0.0.1:6000 and get seemlessly translated to 207.156.7.15:80.
I tried the following without success:
iptables -t nat -A PREROUTING -p tcp -d 127.0.0.1 -i lo --dport 6000 -j DNAT--to-destination 207.156.7.15:80
iptables -t nat -A POSTROUTING -p tcp -d 207.156.7.15 -o eth0 --dport 80 -j SNAT --to-source 127.0.0.1
Quoted 7 lines · Brett Simpson
I've tried a number of different PREROUTING and POSTROUTING rules and can't seem to make this work.
I have a system with a single nic (eth0). While I'm on the system via a shell I would like to connect to 127.0.0.1:6000 and get seemlessly translated to 207.156.7.15:80.
Quoted 7 lines
I tried the following without success:
iptables -t nat -A PREROUTING -p tcp -d 127.0.0.1 -i lo --dport 6000 -j
DNAT--to-destination 207.156.7.15:80iptables -t nat -A POSTROUTING -p tcp -d 207.156.7.15 -o eth0 --dport 80 -j SNAT --to-source 127.0.0.1
Try:
iptables -A OUTPUT -t nat -p tcp --dport 6000 -d 127.0.0.1 -j DNAT --to 207.156.7.15:80
Regards,
Antony.
Signature · 6 lines
The words "e pluribus unum" on the Great Seal of the United States are from a
poem by Virgil entitled "Moretum", which is about cheese and garlic salad
dressing.
Please reply to the list;
please don't CC me.Quoted 14 lines · Antony Stone
Quoted 12 lines · Brett Simpson
I've tried a number of different PREROUTING and POSTROUTING rules and can't seem to make this work.
I have a system with a single nic (eth0). While I'm on the system via a shell I would like to connect to 127.0.0.1:6000 and get seemlessly translated to 207.156.7.15:80.
I tried the following without success:
iptables -t nat -A PREROUTING -p tcp -d 127.0.0.1 -i lo --dport 6000 -j
DNAT--to-destination 207.156.7.15:80
Quoted 7 lines
Quoted 2 lines
iptables -t nat -A POSTROUTING -p tcp -d 207.156.7.15 -o eth0 --dport 80 -j SNAT --to-source 127.0.0.1
Try:
iptables -A OUTPUT -t nat -p tcp --dport 6000 -d 127.0.0.1 -j DNAT --to 207.156.7.15:80
Didn't work. Would the INPUT chain help?
iptables -t nat -A OUTPUT -p tcp --dport 6000 -d 127.0.0.1 -j DNAT --to 207.156.7.15:80
iptables -t nat -A POSTROUTING -p tcp -d 207.156.7.15 -o eth0 --dport 80 -j SNAT --to-source 127.0.0.1
Quoted 17 lines · Brett Simpson
Quoted 16 lines · Antony Stone
Quoted 14 lines · Brett Simpson
I've tried a number of different PREROUTING and POSTROUTING rules and can't seem to make this work.
I have a system with a single nic (eth0). While I'm on the system via a shell I would like to connect to 127.0.0.1:6000 and get seemlessly translated to 207.156.7.15:80.
I tried the following without success:
iptables -t nat -A PREROUTING -p tcp -d 127.0.0.1 -i lo --dport 6000
-j DNAT--to-destination 207.156.7.15:80iptables -t nat -A POSTROUTING -p tcp -d 207.156.7.15 -o eth0 --dport 80 -j SNAT --to-source 127.0.0.1
Quoted 6 lines
Quoted 4 lines
Try:
iptables -A OUTPUT -t nat -p tcp --dport 6000 -d 127.0.0.1 -j DNAT --to 207.156.7.15:80
Didn't work. Would the INPUT chain help?
No, I don't think so. INPUT is only for the reply packets. I'm assuming
you're allowing those back in to your machine (!?), so the problem is getting the outbound packets to the right destination with the right return address.
Quoted 4 lines
iptables -t nat -A OUTPUT -p tcp --dport 6000 -d 127.0.0.1 -j DNAT --to 207.156.7.15:80
iptables -t nat -A POSTROUTING -p tcp -d 207.156.7.15 -o eth0 --dport 80 -j SNAT --to-source 127.0.0.1
Duh :) I forgot about the reply address :)
My rule will send packets to 207.156.7.15 with a source address of 127.0.0.1
Not surprisingly, you don't get anything back...
Try:
iptables -A OUTPUT -t nat -p tcp --dport 6000 -d 127.0.0.1 -j DNAT --to 207.156.7.15:80
iptables -A POSTROUTING -t nat -p tcp --dport 80 -d 207.156.7.15 -s 127.0.0.1 -j SNAT --to a.b.c.d
Where a.b.c.d is the routable address of your machine, to which reply packets can successfully return.
Regards,
Antony.
Signature · 4 lines
Behind the counter a boy with a shaven head stared vacantly into space, a dozen spikes of microsoft protruding from the socket behind his ear. - William Gibson, Neuromancer (1984)
Quoted 17 lines · Antony Stone
Quoted 9 lines · Brett Simpson
Quoted 8 lines · Antony Stone
Quoted 7 lines · Brett Simpson
I've tried a number of different PREROUTING and POSTROUTING rules and can't seem to make this work.
I have a system with a single nic (eth0). While I'm on the system via a shell I would like to connect to 127.0.0.1:6000 and get seemlessly translated to 207.156.7.15:80.
My rule will send packets to 207.156.7.15 with a source address of 127.0.0.1
Not surprisingly, you don't get anything back...
Try:
Quoted 7 lines
iptables -A OUTPUT -t nat -p tcp --dport 6000 -d 127.0.0.1 -j DNAT --to 207.156.7.15:80
iptables -A POSTROUTING -t nat -p tcp --dport 80 -d 207.156.7.15 -s 127.0.0.1 -j SNAT --to a.b.c.dWhere a.b.c.d is the routable address of your machine, to which reply packets can successfully return.
Still no go. My machine is 172.27.228.145. I'm using lynx for the browser on my machine.
iptables -A OUTPUT -t nat -p tcp --dport 6000 -d 127.0.0.1 -j DNAT --to 207.156.7.15:80
iptables -A POSTROUTING -t nat -p tcp --dport 80 -d 207.156.7.15 -s 127.0.0.1 -j SNAT --to 172.27.228.145
Thanks,
Brett
Quoted 23 lines · Brett Simpson
Quoted 22 lines · Antony Stone
Quoted 8 lines · Brett Simpson
Quoted 7 lines · Antony Stone
Quoted 6 lines · Brett Simpson
I've tried a number of different PREROUTING and POSTROUTING rules and can't seem to make this work.
I have a system with a single nic (eth0). While I'm on the system via a shell I would like to connect to 127.0.0.1:6000 and get seemlessly translated to 207.156.7.15:80.
My rule will send packets to 207.156.7.15 with a source address of 127.0.0.1
Not surprisingly, you don't get anything back...
Try:
iptables -A OUTPUT -t nat -p tcp --dport 6000 -d 127.0.0.1 -j DNAT --to 207.156.7.15:80
iptables -A POSTROUTING -t nat -p tcp --dport 80 -d 207.156.7.15 -s 127.0.0.1 -j SNAT --to a.b.c.d
Quoted 5 lines
Quoted 2 lines
Where a.b.c.d is the routable address of your machine, to which reply packets can successfully return.
Still no go. My machine is 172.27.228.145. I'm using lynx for the browser on my machine.
That's not a routable address.
How are packets from the machine we are talking about routed to and from the
Internet? Where is NAT taking place?
Antony.
Signature · 6 lines
The first fifty percent of an engineering project takes ninety percent of the
time, and the remaining fifty percent takes another ninety percent of the
time.
Please reply to the list;
please don't CC me.Quoted 7 lines · Antony Stone
Quoted 2 lines
Still no go. My machine is 172.27.228.145. I'm using lynx for the browser on my machine.
That's not a routable address.
How are packets from the machine we are talking about routed to and from the
Internet? Where is NAT taking place?
Oops. I meant to use 207.156.7.115 instead of 207.156.7.15. Typo. :-)
The machine has a default gateway set to a cisco router (172.27.228.1). It routes to firewall and out to the internet. Other than that I have no other routes in place but I can access port 80 on 207.156.7.115.
[root@simpsonb proxy-2.2.4]# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use
Iface
172.16.225.0 0.0.0.0 255.255.255.0 U 0 0 0
vmnet8
172.16.76.0 0.0.0.0 255.255.255.0 U 0 0 0
vmnet1
172.27.228.0 0.0.0.0 255.255.255.0 U 0 0 0
eth0
172.27.0.0 0.0.0.0 255.255.0.0 U 0 0 0
eth0
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0
eth0
127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0
lo
0.0.0.0 172.27.228.1 0.0.0.0 UG 0 0 0
eth0
[root@simpsonb proxy-2.2.4]#
Browser
172.27.228.145
| | Default GW 172.27.228.1 Router A | | 172.16.3.119 Router B | | 172.16.21.102 Firewall 207.156.7.1 | |
207.156.7.115
Web server
Quoted 2 lines · Antony Stone
How are packets from the machine we are talking about routed to and from the
Internet? Where is NAT taking place?
I got it working! Actually I was testing on Redhat Enterprise Linux ES 3 (RHEL) with no success so I went to Gentoo and was able to get it to work with the following...
iptables -t nat -A OUTPUT -p tcp --dport 6000 -d 127.0.0.1 -j DNAT --to 207.156.7.115:80
iptables -t nat -A POSTROUTING -p tcp -d 207.156.7.115 -o eth0 --dport 80 -j SNAT --to-source 172.27.228.220
I suspect that RHEL doesn't have 'NAT of local connections' compiled into the kernel.
Thanks for everyone help,
Brett
Quoted 8 lines · Brett Simpson
I've tried a number of different PREROUTING and POSTROUTING rules and can't seem to make this work.
I have a system with a single nic (eth0). While I'm on the system via a shell I would like to connect to 127.0.0.1:6000 and get seemlessly translated to 207.156.7.15:80.
I tried the following without success:
iptables -t nat -A PREROUTING -p tcp -d 127.0.0.1 -i lo --dport 6000 -j DNAT--to-destination 207.156.7.15:80
iptables -t nat -A POSTROUTING -p tcp -d 207.156.7.15 -o eth0 --dport 80 -j SNAT --to-source 127.0.0.1
Hmmm . . . not sure, never tried it. What happens if you move your first rule to -t nat OUTPUT instead of -t nat PREROUTING?
Signature · 9 lines
John A. Sullivan III Chief Technology Officer Nexus Management +1 207-985-7880 [email protected] --- If you are interested in helping to develop a GPL enterprise class VPN/Firewall/Security device management console, please visit http://iscs.sourceforge.net
Quoted 6 lines · Brett Simpson
I've tried a number of different PREROUTING and POSTROUTING rules and can't seem to make this work.
I have a system with a single nic (eth0). While I'm on the system via a shell I would like to connect to 127.0.0.1:6000 and get seemlessly translated to 207.156.7.15:80.
I might as well just check something rather obvious:
Can you access 207.156.7.15:80 from the machine we are talking about?
ie: assuming we get the NAT to work the way you want, do the packets get to the remote server and the replies back again okay?
Antony.
Signature · 5 lines
If you can't find an Open Source solution for it, then it isn't a real
problem.
Please reply to the list;
please don't CC me.Quoted 5 lines · Antony Stone
Quoted 3 lines · Brett Simpson
I've tried a number of different PREROUTING and POSTROUTING rules and can't seem to make this work.
Quoted 7 lines
Quoted 3 lines
I have a system with a single nic (eth0). While I'm on the system via a shell I would like to connect to 127.0.0.1:6000 and get seemlessly translated to 207.156.7.15:80.
I might as well just check something rather obvious:
Can you access 207.156.7.15:80 from the machine we are talking about?
Yes.
Quoted 2 lines
ie: assuming we get the NAT to work the way you want, do the packets get to the remote server and the replies back again okay?
Check that you have Netfilter kernel support for 'NAT of local connections' (this may or may not help).
Quoted 8 lines · Brett Simpson
I've tried a number of different PREROUTING and POSTROUTING rules and can't seem to make this work.
I have a system with a single nic (eth0). While I'm on the system via a shell I would like to connect to 127.0.0.1:6000 and get seemlessly translated to 207.156.7.15:80.
I tried the following without success:
iptables -t nat -A PREROUTING -p tcp -d 127.0.0.1 -i lo --dport 6000 -j DNAT--to-destination 207.156.7.15:80
iptables -t nat -A POSTROUTING -p tcp -d 207.156.7.15 -o eth0 --dport 80 -j SNAT --to-source 127.0.0.1
Signature · 7 lines
Bryan McAninch Network Security Engineer Penson Financial Services, Inc. 214.765.1366
Quoted 2 lines · B. McAninch
Check that you have Netfilter kernel support for 'NAT of local connections' (this may or may not help).
The source shows it's enabled. But since the binary Redhat kernel RPM doesn't always match what's in /usr/src/linux-2.4 do you know of another way I can check if it's enabled?
[*] NAT of local connections (READ HELP)
Thanks,
Brett