router/nat with only one NIC
Tim Wunder
tim
Sun Sep 26 08:36:03 PDT 2004
On Saturday 25 September 2004 7:09 pm, someone claiming to be David Bandel
wrote:
> On Sat, 25 Sep 2004 10:59:11 -0400, Tim Wunder <tim at thewunders.org> wrote:
> > On Saturday 25 September 2004 9:28 am, someone claiming to be Tim Wunder
> >
> > wrote:
> > > On Wednesday 08 September 2004 8:14 pm, someone claiming to be David A.
> > > Bandel
>
> [snip]
>
> > > nat requests from 10.0.0.0/24 thru 192.168.1.2 (eth0 on the server):
> > > # iptables -t nat -I POSTROUTING -s 10.0.0.0/24 -j SNAT --to-source
> > > 192.168.1.2
> >
> > Shouldn't these be DNAT rules? Aren't I trying to change the DESTINATION
> > of the packets?
> >
> > > redirect http requests thru dansguardian:
> > > # iptables -t nat -I POSTROUTING -s 10.0.0.0/24 -j SNAT -p tcp --sport
> > > 80 --to-source 192.168.1.2:3129
> > >
> > > redirect squid requests thru dansguardian:
> > > # iptables -t nat -I POSTROUTING -s 10.0.0.0/24 -j SNAT -p tcp --sport
> > > 3128 --to-source 192.168.1.2:3129
>
> SNAT changes source (from) address
> DNAT changes destination (to) address/port
>
> SNAT: POSTROUTING
> DNAT: PREROUTING
>
> OK, I'm confused. You have a router/NAT box 192.168.1.254. It should
> redirect all packets on port 80 that _don't_ come from 192.168.1.2
> back to 1.2 port 3128.
>
Sort of, I want it to redirect the packets to 1.2 port 3129.
> Remind me what 10.x.x.x is for? Why not part of 192.168.1.0/24?
>
No real reason, I suppose I could use 192.168.1.0/24. Didn't think it'd
matter. Apaprently, my ignorance is hanging out again...
> > I want http and squid (ports 80 and 3128) packets sent from 10.0.0.0/24
> > to go to thru dansguardian (port 3129) on 192.168.1.2 via transparent
> > proxy. All other packets I want to have go through the router located on
> > 192.168.1.254.
>
> Don't you mean port 3128? And where does 10.0.0.x come from?
>
Dansguardian listens to port 3129 and forwards acceptable packets to squid,
which listens on 3128. Dansguardian does a much better job of content
filtering than squidGuard, which I've also configured squid to use.
> > Now 192.168.1.254 also does NAT, but it's only NAT'ing packets from
> > 192.168.1.2
>
> Seems kinda silly, but OK.
I want to prevent my kids from just connecting to the internet and bypassing
the content filter. Tha's all.
> So where is 10.x.x.x hanging out? Which
> system/ethernet port?
>
eth0:1 on the proxy server. But if it'd make more sense, I'll just make eth0:1
be 192.168.1.1, and I'll have the dhcp server serve up 192.168.1.0/24 IP
addresses ( just not 192.168.1.1, 1.2 or 1.254).
> > So... I'm doing SNAT for ports other than 80 and 3128 and DNAT for 80 and
> > 3128. Is that right?
> >
> > I'll have to play around some more, but any suggestions/guidance would be
> > welcome. Off to take car of some "honey-do's"...
>
> Sounds like some of what you want might be better served with a VLAN,
> at least for the10.x.x.x stuff. But somewhere I'm still not clear.
>
VLAN? Yeah... I guess that's what I was trying to set up. But I don't have to.
I'll change everything so that the proxy/dhcp server gives out 192.168.1.x IP
addresses and do everything on 192.168.1.0/24.
So... the question remains...
How do I make port 80 requests from 192.168.1.0/24 go through 192.168.1.2 port
3129? Additionally, how do I make everything look like it's coming from
192.168.1.2 to the router at 192.168.1.254.
This is my current network config:
# ifconfig
eth0 Link encap:Ethernet HWaddr 00:60:97:29:68:98
inet addr:192.168.1.2 Bcast:192.168.1.255 Mask:255.255.255.0
inet6 addr: fe80::260:97ff:fe29:6898/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:661095 errors:0 dropped:0 overruns:0 frame:0
TX packets:663681 errors:0 dropped:0 overruns:0 carrier:4
collisions:54 txqueuelen:1000
RX bytes:364144548 (347.2 Mb) TX bytes:284783379 (271.5 Mb)
Interrupt:11 Base address:0xe400
eth0:1 Link encap:Ethernet HWaddr 00:60:97:29:68:98
inet addr:192.168.1.1 Bcast:192.168.1.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:661095 errors:0 dropped:0 overruns:0 frame:0
TX packets:663681 errors:0 dropped:0 overruns:0 carrier:4
collisions:54 txqueuelen:1000
RX bytes:364144548 (347.2 Mb) TX bytes:284783379 (271.5 Mb)
Interrupt:11 Base address:0xe400
# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0
0.0.0.0 192.168.1.254 0.0.0.0 UG 0 0 0 eth0
# cat /proc/sys/net/ipv4/conf/eth0/send_redirects
0
# cat /proc/sys/net/ipv4/ip_forward
1
# iptables -L -t nat
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
REDIRECT tcp -- anywhere anywhere tcp dpt:http
OWNERGID match GID1 redir ports 3129
REDIRECT tcp -- anywhere anywhere tcp dpt:http
OWNERGID match GID2 redir ports 3129
REDIRECT tcp -- anywhere anywhere tcp dpt:squid
OWNER GID match GID1 redir ports 3129
REDIRECT tcp -- anywhere anywhere tcp dpt:squid
OWNER GID match GID2 redir ports 3129
For added edification, my laptop is getting IP address 192.168.1.110 from the
dhcp server.
# ifconfig
eth0 Link encap:Ethernet HWaddr 00:0C:F1:0B:17:19
inet addr:192.168.1.110 Bcast:192.168.1.255 Mask:255.255.255.0
inet6 addr: fe80::20c:f1ff:fe0b:1719/64 Scope:Link
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:404 errors:0 dropped:0 overruns:0 frame:0
TX packets:429 errors:0 dropped:0 overruns:0 carrier:1
collisions:0 txqueuelen:1000
RX bytes:48391 (47.2 Kb) TX bytes:36935 (36.0 Kb)
Interrupt:11 Base address:0x1000 Memory:c0204000-c0204fff
# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth0
0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 eth0
And pings work for 192.168.1.1, 192.168.1.2 and 68.34.76.5 (ISP's DNS server)
from the laptop.
What doesn't work is Internet (DNS, actually). :-(
Regards,
Tim
--
Fedora Core 2, Kernel 2.6.7-1.494.2.2, KDE 3.3.0, Xorg 6.7.0
08:30:00 up 7 days, 22:37, 11 users, load average: 0.00, 0.00, 0.00
It's what you learn after you know it all that counts
More information about the Linux-users
mailing list