Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

i have a small network, with one valid IP and a firewall with 3 network interfaces (LAN, WAN, DMZ).

  • I want to enable PAT on this valid IP to redirect http traffic to a server in my DMZ. (done)
  • I want to enable MASQ on this ip from traffic that comes from my LAN (done)
  • I want from my LAN as well to access my http server at DMZ. (partially)

Question:

in the above scenario, i cannot from my LAN, to access my http server in the DMZ, since it has the IP used by the MASQ (the only valid ip that i have). What would be the best option to solve this problem?

network interfaces:

  • eth0 (WAN)
  • eth1 (DMZ)
  • eth2 (LAN)

    /sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

    /sbin/iptables -A FORWARD --o eth1 -d 2.2.2.2 -p tcp --dport 80 -j ACCEPT

    /sbin/iptables -t nat -A PREROUTING -i eth0 -d 1.1.1.1 -p tcp --dport 80 -j DNAT --to 2.2.2.2

    /sbin/iptables -A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT

    /sbin/iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT

    /sbin/iptables -A FORWARD -i eth2 -o eth0 -j ACCEPT

share|improve this question
    
You probably did points 1 and 2 wrong. Without seeing your firewall rules, it is hard to say what is wrong and what you should to do get the third correctly. –  Juliano Mar 4 '11 at 17:07
    
if i have the ip 1.1.1.1 assigned to my WAN interface, i do a PAT to any to 1.1.1.1:80 redirect to my server at DMZ (2.2.2.2:80). it works. if i want to surf from my LAN using MASQ it works. what doesn't work is from my LAN if i try to access 1.1.1.1:80. Maybe because it's the same IP used for my MASQ? –  VP. Mar 4 '11 at 17:29
    
What Juliano said. It's all very well trying to anonymise this, but it's difficult to diagnose without more data. Feel free to anonymise your public ip address, by all means, but could we see the rest of your addressing scheme and firewall rules? –  MadHatter Mar 4 '11 at 17:38
    

3 Answers 3

up vote 2 down vote accepted

I'm a bit confused with your explanation. So I'll just use a sample scenario here:

  • eth0 = WAN = 123.11.22.33
  • eth1 = DMZ = 192.168.1.0/24
  • eth2 = LAN = 172.16.0.0/16

And the webserver is given 192.168.1.55

# First, allow LAN & DMZ to access the outside world
-t nat -A POSTROUTING -o eth0 -j MASQUERADE
# Now, allow outside access to the webserver
-t nat -A PREROUTING -i eth0 -d 123.11.22.33 -p tcp --dport 80 -j DNAT --to 192.168.1.55:80
# Finally, allow forwarding
-A FORWARD -m state --state ESTABLISHED -j ACCEPT
-A FORWARD -d 191.168.1.55 -p tcp --dport 80 -j ACCEPT
-A FORWARD -i eth1 -j ACCEPT
-A FORWARD -i eth2 -j ACCEPT

If you need more security, feel free to expand the last two lines above, e.g.:

-N eth1_fwd
-N eth2_fwd
-A FORWARD -i eth1 -g eth1_fwd
-A FORWARD -i eth2 -g eth2_fwd
-A eth1_fwd -s ...... -j ACCEPT
...
-A eth2_fwd -s ...... -j ACCEPT
...

Hope this helps. Don't forget to add a default route toward the default gateway of eth0 :)

edit: oops, wrong ifaces on the later rules

share|improve this answer

Sounds like you are just having the standard hairpin NAT issue.

A common solution to the problem is to give your host in the DMZ an a private IP, on a different subnet, and setup split DNS. You server the private address to the internal hosts, and the external hosts will get the public address. You then have firewall rules to permit internal clients to the private DMZ subnet, and you have a NAT, and rule to forward from the address/port from to the web server in your DMZ.

share|improve this answer
    
It should be possible to do the hairpin NAT with iptables, I just rarely deal with it that way since I usually already have a split DNS since I don't want internal stuff leaking to the outside. –  Zoredache Mar 4 '11 at 18:55
    
so as i understood, here i would use routing to reach my DMZ and not NAT, right? The problem is that, without NAT, if my DMZ get compromised then it's possible to reach my LAN (even with fw rules). with NAT i have a better security. –  VP. Mar 5 '11 at 10:52

As an example of a problem that could be caused by topology - if your internal networks DMZ and LAN are using overlapping subnets, then this could cause the problem you are seeing because the LAN machine would not send packets destined for the DMZ machine to the firewall/default route (since it would think the DMZ machine is local).

That said, you said that browsing from your LAN to 1.1.1.1:80 is not working. That makes sense because your DNAT rule is restricted to packets that come in eth0 (the -i eth0), so it won't DNAT packets coming from eth2 and headed to 1.1.1.1:80. I don't see a good reason to restrict that PREROUTING rule to a specific ethernet interface.

Does hitting 2.2.2.2:80 work from the LAN host?

share|improve this answer
    
no since my LAN ist 3.3.3.3 and there is no routing to reach the 2.2.2.2. –  VP. Mar 5 '11 at 10:53

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.