Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a server handling several services. For the purposes of this questions, suppose one of them is mail. If mail goes down, I want to forward it to another host. My network looks like this:

-- Network 1 --

Box 1
eth1: 192.168.1.5
eth0: 10.10.10.3

-- Network 2 --

Box 2
eth0: 10.10.10.5

So... Incoming requests are coming to the 192.168.1.5 address on eth1 on box 1. Instead of stopping there, I want to forward them over eth0 to box 2 and let that handle it.

I've tried the following iptables rules:

iptables -t nat -A PREROUTING -p tcp -m tcp -d 192.168.1.5 --dport 25 -j DNAT --to-destination 10.10.10.5:25
iptables -A FORWARD -m state -p tcp -d 10.10.10.5 --dport 25 --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -p tcp -m tcp -s 10.10.10.5 --sport 25 -j SNAT --to-source 192.168.1.5

... To no avail. Using tcpdump, I can see the request come in on the 2nd box, but nothing happens on the requesting computer.

Please help. Thanks!

share|improve this question
    
Is there a reason youre not using some sort of HA solution (such as pacemaker)? Migrating resources in the event of a failure is exactly what it was made to do. –  Patrick Mar 29 '12 at 3:09
    
As for the reason it fails, its because 'box 2' is sending traffic back to the original host, but now its coming from the wrong IP. The traffic has to flow back out box 1 so that it can rewrite the reply packet to come from the 192.168.1.5 address (thats not what your 3rd rule is doing. I cant tell what youre trying to do with that one) –  Patrick Mar 29 '12 at 3:14
add comment

3 Answers

If you need help with this, I suggest that you show full iptables ruleset. A few packets from tcpdump wouldn't hurt either.

Meanwhile:

Do you have ip forwarding enabled? Check with:

sysctl net.ipv4.conf.all.forwarding

Set with:

sysctl net.ipv4.conf.all.forwarding=1

Make permanent by adding to /etc/sysctl.conf (or where your distribution expects it).

You need to allow forwarding for the opposite direction as well, add a forward rule for -s 10.10.10.5 and -o eth1 too (in case you dont have that, or a catch-all/default policy ACCEPT already):

iptables -A FORWARD -s 10.10.10.5 -o eth1 -j ACCEPT
share|improve this answer
    
That really is the full iptables ruleset - the box is not doing anything else with iptables. –  Erick Mar 28 '12 at 6:47
    
The forwarding is enabled. –  Erick Mar 28 '12 at 6:48
add comment

Ended up using xinetd to deal with mail for now.

service smtp
{
        disable = no
        socket_type     = stream
        wait            = no
        user            = root
        redirect        = 10.10.10.5 25
        log_on_failure  += USERID
}

Thanks for your help everyone!

share|improve this answer
add comment

A few comments in general:

  • You probably want to match on interfaces as well as just tcp/ip source/destination/ports
  • I'm not really sure the POSTROUTING/snat rule is needed, for what you're trying to accomplish. DNAT have already translated the source address of the packet before POSTROUTING.

One possible reason you weren't seeing any replies at the client could be the routing table on Box 2. DNAT doesn't rewrite the source-address, and in order for DNAT to work, Box 2 needs a route back to the source that goes through Box 1. If this is "an arbitrary ip address", Box 2 would need it's default route via Box 1, if it's specific networks, return routes to those networks through Box 1 would do.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.