iptables DNAT problem from internal net

Hello,

I have configured my firewall to DNAT the following adresses to
be forwarded to internal server.

217.5.155.20, 217.5.155.22

On 217.5.155.22 you will see an apache server running on Windows
On 217.5.155.20 you will see an apache server running on Linux 7.3

If I try to connect to them from internal, I can't see these pages.

Any help ?

Thanks

Lothar

Dans sa prose, Lothar Behrens nous ecrivait :
> I have configured my firewall to DNAT the following adresses to be
> forwarded to internal server.
> 217.5.155.20, 217.5.155.22
> On 217.5.155.22 you will see an apache server running on Windows On
> 217.5.155.20 you will see an apache server running on Linux 7.3
> If I try to connect to them from internal, I can't see these pages.

It's a very common issue.

When you try to connect to your DNATed addresses from the LAN, this is
what happens. Suppose A is LAN host, S DNATed server and G the gateway.

A sends SYN to 217.5.155.20 via G (defautl gateway)
G DNATs 217.5.155.20 to IP(S) and routes SYN to S
S recieve a SYN from A and replies SYN-ACK

For A is in the same subnet than S, S sends SYN-ACK directly to A, not
using G as gateway. Thus, SYN-ACK can't be deDNATed.

A recieve a SYN-ACK from S

For A waits for a SYN-ACK from 217.5.155.20, it drops S SYN-ACK and you
can't connect.

To make to whole thing work, you have to force S to reply through G for
S packets to A get deDNATed. The simpliest way to achieve this a to set a
SNAT rule on G, for LAN sourced connections to S :

iptables -t nat -A POSTROUTING -s <LAN> -d <IP(S)> -j SNAT \
--to <IP(G) on LAN>

Do it for both 217.5.155.20 and 217.5.155.22 DNAT targets and you're done.

--
Usenet: lisez bourré, postez déchirés.
-+- LC in <http://neuneu.mine.nu> : Le postage sans peine. -+-

I am still fighting with this in some ways, but a cleaner and simpler
solution (if you are on a private IP subnet) is to just put the http
server on its own subnet. The IPs you use seem to be "real" but in that
case the problem would be better solved with iproute2 anyhow ...

Rudolf

[Snip]pets of what Cedric Blancher <(E-Mail Removed)> wrote:
: Dans sa prose, Lothar Behrens nous ecrivait :
:> I have configured my firewall to DNAT the following adresses to be
:> forwarded to internal server.
:> 217.5.155.20, 217.5.155.22
:> On 217.5.155.22 you will see an apache server running on Windows On
:> 217.5.155.20 you will see an apache server running on Linux 7.3
:> If I try to connect to them from internal, I can't see these pages.

: It's a very common issue.

--
It would be really bad for my selfesteem to marry someone I don't love.
It would make me feel like I am selling myself.
-- Marije
Interesting. In the American system it would be good for your selfesteem:
"look I am important enough that this *rich* guy will marry me!"
--Rudolf