Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Linux router like:

İnternet <-> Linux <-> DMZ

We have /25 subnet of 128 IP addresses. Those are NATed into servers in DMZ. If I did not configure all of these IP addresses as IP aliases in external interface of Linux, those IPs did not work.

Lets example, 212.123.123.45 IP is not defined in Linux. I see packets targeted to 212.123.123.45 at external interface of Linux with tcpdump. However, NAT rules does not work. If I define 212.123.123.45 as eth1:1 at external interface, NAT rules start to work.

Kernel is 2.6.18 latest Centos 5.5 kernel.

I need your kind comments.

Regards,

share|improve this question
add comment

migrated from stackoverflow.com Jun 14 '11 at 7:55

This question came from our site for professional and enthusiast programmers.

1 Answer

My comment is your network as working as NAT is designed. Without configuring the public IP address for the NAT, the NAT cannot work.

Interface alias is one way to solve the addressing problem. For a more modern ip addressing tool, please see iproute2.

share|improve this answer
    
The important point is packets are already routed by frontend router. I see the packets in incoming interface already. The point is that, NAT does not work until I add the destiation IP as IP alias. –  seaquest Jun 14 '11 at 17:14
    
Routing is necessary but not sufficient. You need the destination as you've learned. –  dmourati Jun 14 '11 at 18:59
    
This is al Lİnux router. It should be able to process(route, NAT etc) packets not destined to itself. –  seaquest Jun 15 '11 at 4:22
    
You have two choices: either NAT as you mention above, or route the IP to the target. If you NAT, the public IP must live on the NAT device. It seems you need to read and understand the Linux NAT howto, specifically: netfilter.org/documentation/HOWTO//NAT-HOWTO-9.html. While that section pertains more directly to SNAT and you are speaking above more about DNAT, the requirement still holds. –  dmourati Jun 15 '11 at 5:57
    
Actually I read most ofthe howto. The specific page says the packets you NATed should come back to you for deNAT. No problem. In my case I am already the router and all of the packets has to come to my router. –  seaquest Jun 17 '11 at 20:41
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.