-1

I have a Linux router like:

İnternet <-> Linux <-> DMZ

We have /25 subnet of 128 IP addresses. Those are NATed into servers in DMZ. If I did not configure all of these IP addresses as IP aliases in external interface of Linux, those IPs did not work.

Lets example, 212.123.123.45 IP is not defined in Linux. I see packets targeted to 212.123.123.45 at external interface of Linux with tcpdump. However, NAT rules does not work. If I define 212.123.123.45 as eth1:1 at external interface, NAT rules start to work.

Kernel is 2.6.18 latest Centos 5.5 kernel.

I need your kind comments.

Regards,

Improve this question
0

1 Answer 1

Reset to default
1

My comment is your network as working as NAT is designed. Without configuring the public IP address for the NAT, the NAT cannot work.

Interface alias is one way to solve the addressing problem. For a more modern ip addressing tool, please see iproute2.

Improve this answer
6
  • The important point is packets are already routed by frontend router. I see the packets in incoming interface already. The point is that, NAT does not work until I add the destiation IP as IP alias.
    – seaquest
    Jun 14, 2011 at 17:14
  • Routing is necessary but not sufficient. You need the destination as you've learned.
    – dmourati
    Jun 14, 2011 at 18:59
  • This is al Lİnux router. It should be able to process(route, NAT etc) packets not destined to itself.
    – seaquest
    Jun 15, 2011 at 4:22
  • You have two choices: either NAT as you mention above, or route the IP to the target. If you NAT, the public IP must live on the NAT device. It seems you need to read and understand the Linux NAT howto, specifically: netfilter.org/documentation/HOWTO//NAT-HOWTO-9.html. While that section pertains more directly to SNAT and you are speaking above more about DNAT, the requirement still holds.
    – dmourati
    Jun 15, 2011 at 5:57
  • Actually I read most ofthe howto. The specific page says the packets you NATed should come back to you for deNAT. No problem. In my case I am already the router and all of the packets has to come to my router.
    – seaquest
    Jun 17, 2011 at 20:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .