Hello!
I'm trying to set up a fairly strange configuration, and having
no luck getting MASQUERADE to work. My configuration requires
a few patches to the kernel to allow send-to-self and some
routing table upgrades. I can post these if someone wishes to
see them.
I suspect that my virtual router configuration is confusing iptables
somehow, perhaps causing the -o [port] to be ignored,
so I'm looking for ideas on how to better debug this.
The configuration is a sort of virtual router. You could think of it
similar to this, though I am actually using virtual devices similar
to the etun devices recently posted to netdev instead of real ethernet
devices with loopback cables.
One machine:
eth0 and eth1 act as a router (using policy based routing to filter
on packets entering these interfaces to a certain routing table, etc)
eth2 and eth3 act as a second router.
eth1 is connected with loop-back cable to eth2 (subnet 2.2.2.0/24)
eth0 is connected to eth4 via loopback cable (subnet 172.1.1.0/24)
eth3 is connected to the5 via loopback cable. (subnet 4.4.4.0/24)
I am trying to pass traffic from eth4 to eth5, through the virtual
routers. This works fine without NAT, and I can sniff on each of the
interfaces and see expected traffic.
The traffic path is: eth4 -- eth0 { router-1 logic } eth1 -- eth2 { router-2 logic } eth3 -- eth5
I then tried enabling NAT on eth1 so that all packets entering eth2 will appear
to come from eth1's IP address with a command similar to this:
iptables -A POSTROUTING -t nat -o eth1 -j MASQUERADE
When sniffing eth2, I still see the source IP as that of eth4, not eth1.
I also tried using the SNAT target with this command:
iptables -A POSTROUTING -t nat -o eth1 -j SNAT --to 2.2.2.2
The rule appears to be in the kernel, but it still does not work:
[root@lanforge-33-46 lanforge]# iptables -t nat -L -n
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
[root@lanforge-33-46 lanforge]# iptables -t nat -L -n
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
SNAT all -- 0.0.0.0/0 0.0.0.0/0 to:2.2.2.2
If anyone has any ideas how to better diagnose this, please let
me know.
Thanks,
Ben
--
Ben Greear <greearb@xxxxxxxxxxxxxxx>
Candela Technologies Inc http://www.candelatech.com
