Mailinglist Archive: opensuse-security (465 mails)

< Previous Next >
DNAT / routing problem ...
  • From: Ray Leach <raymondl@xxxxxxxxxxxxxxxxxxxxxx>
  • Date: Mon, 10 Dec 2001 13:13:31 +0200
  • Message-id: <20011210111055.06ED4E6361@xxxxxxxxxxxx>
Hi

If anybody can shed some light here ...

I have SuSE 7.2 with iptables 1.2.4.

This is my setup :

Internet host (INT1)
|
|
Internet Router (66.8.45.161/28)
|
|
eth0: 66.8.45.162 eth0:0: 66.8.45.171
Firewall ------ eth1: 192.168.1.1/24 ----- DMZ Web Server (192.168.1.3) (WEB1)
eth2: 10.0.0.2
|
|
Internal LAN Machine (10.0.0.67) (LAN1)


If I browse from LAN1 to WEB1 I get the expected web page.

If I ping eth0:0 (66.8.45.171) from an internet host I get a reponse.

If I browse eth0:0 (66.8.45.171) from an internet host (INT1), then this is what I see on the firewall logs:

Dec 10 12:49:32 firefly kernel: IN INT TO ORA1: IN=eth0 OUT= MAC=00:01:02:50:b8:9e:00:50:0f:0d:1c:76:08:00 SRC=196.38.2.133 DST=66.8.45.171 LEN=44 TOS=0x00 PREC=0x00 TTL=246 ID=33551 DF PROTO=TCP SPT=35511 DPT=80 WINDOW=8760 RES=0x00 SYN URGP=0

This is what I get from a tcpdump -i eth0 src or dst 66.8.45.171:

firefly:~ # tcpdump -n -i eth0 src or dst 66.8.45.171
Kernel filter, protocol ALL, datagram packet socket
tcpdump: listening on eth0
13:09:24.168125 196.38.2.133.35555 > 66.8.45.171.http: S 1553437572:1553437572(0) win 8760 <mss 1460> (DF)
13:09:24.378125 196.38.2.133.35555 > 192.168.1.3.http: S 1675349120:1675349120(0) win 8760 <mss 1380> (DF)
13:09:35.018125 196.38.2.133.35555 > 66.8.45.171.http: R 1553437573:1553437573(0) win 8760 (DF)
13:09:35.108125 196.38.2.133.35555 > 192.168.1.3.http: R 1675349121:1675349121(0) win 8760 (DF)
13:09:36.978125 196.38.2.133.35557 > 66.8.45.171.http: S 1556456834:1556456834(0) win 8760 <mss 1460> (DF)
13:09:37.248125 196.38.2.133.35557 > 192.168.1.3.http: S 2504752814:2504752814(0) win 8760 <mss 1380> (DF)
13:09:40.478125 196.38.2.133.35557 > 66.8.45.171.http: S 1556456834:1556456834(0) win 8760 <mss 1460> (DF)
13:09:40.498125 196.38.2.133.35557 > 192.168.1.3.http: S 2504752814:2504752814(0) win 8760 <mss 1380> (DF)
13:09:46.878125 196.38.2.133.35557 > 66.8.45.171.http: S 1556456834:1556456834(0) win 8760 <mss 1460> (DF)
13:09:47.218125 196.38.2.133.35557 > 192.168.1.3.http: S 2504752814:2504752814(0) win 8760 <mss 1380> (DF)

It seems like my NAT rule on the PREROUTING chain is doing its work (translating 66.8.45.171 to 192.168.1.1), however no traffic every reaches 192.168.1.3.

What am I doing wrong?

Ray


< Previous Next >
This Thread
  • No further messages