On 23.12.2009 21:40, Pascal Hambourg wrote: > Hello, > > Mart Frauenlob a écrit : >> >> Nick Peirson wrote: >>> >>> We've got a couple of servers with external IP addresses NAT'd to internal >>> IP addresses. Unfortunately the firewall that's performing the NAT isn't >>> under our control and we have a problem where the servers can't access each >>> other via their external IPs. > > This is a common problem. > >>> This causes a problem when we use domain names >>> on the servers, as the DNS lookup returns the external IP address. Ideally >>> I'd like to avoid maintaing hosts files or an internal DNS server. >>> >>> I looked to solve this with a iptables rule on each of the servers as >>> follows: >>> iptables -t mangle -A PREROUTING -d 1.1.1.32/29 -j NETMAP --to 2.2.2.32/29 >>> >>> where 1.1.1.32/29 is the range of external IPs and 2.2.2.32/29 is the range >>> of internal IPs. > > Note : the range 192.0.2.0/24 is available and reserved for examples and > documentation. Feel free to use is instead of addresses allocated to > someone else. > >>> I was expecting this to map the IP address from the >>> external to the internal IP. > > Assuming that 1.1.1.32+n maps to 2.2.2.32+n. > >>> Firstly, I'm not sure if this would work at all, and if I'm heading in >>> completely the wrong direction and someone has a better solution, I'd be >>> happy to hear it. > > Can't you just assign the external addresses to the servers as secondary > addresses ? > >>> Secondly, if I've got the right idea my implementation is a little wrong. >>> When I run the command, I get "iptables: Invalid argument", which doesn't >>> provide much info, and I'm not sure how to go about debugging. >> >> wrong table, should be the nat table. > > Wrong chain too. This is locally generated traffic, so the right chain > is OUTPUT, not PREROUTING. Oh, yes I was wrong :/ Don't know why I messed up. sorry for the noise. -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
