Jan Engelhardt a écrit :
On Tuesday 2009-10-20 10:16, Daniel Huhardeaux wrote:
I'm running few virtual machines (kvm+libvirt) on a server (Debian Lenny +
backport kernel 2.6.30) with one public IP and having IP private range
10.99.0.1 for host, one for mail and web VM (10.99.0.13), another for telephony
VM (10.99.0.11).
Everything is working well (DNAT) but something is disturbing me: for instance,
on smtp server, all incoming tcp packets are marked with 10.99.0.1 source IP
and I would like to have "transparent DNAT" which keep the original IP.
You need tproxy then, and not NAT.
Hi Jan,
I think I loaded the well known modules
~$sudo lsmod|grep nf
nf_tproxy_core 3040 1 xt_TPROXY,[permanent]
nf_nat 20068 2 ipt_MASQUERADE,iptable_nat
nf_conntrack_ipv4 15240 15 iptable_nat,nf_nat
nf_conntrack 70000 5
ipt_MASQUERADE,xt_state,iptable_nat,nf_nat,nf_conntrack_ipv4
nf_defrag_ipv4 2288 2 xt_TPROXY,nf_conntrack_ipv4
but can't get it work.
From some doc a table should exist (?)
sudo /sbin/iptables -t tproxy -F
iptables v1.4.2: can't initialize iptables table `tproxy': Table does
not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.
Others say it's a target rule but I can't get it work
~$ sudo iptables -t mangle -A PREROUTING -p tcp --dport 25 -j TPROXY
--on-port 25 --on-ip 10.1.70.13
iptables v1.4.2: Unknown arg `(null)'
Try `iptables -h' or 'iptables --help' for more information.
Thanks for any hint and good and complete doc if any.
--
Daniel
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
