Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a host that has a permanent static GRE tunnel to a server on the Internet. Right now the host has its own real IP address. I want to put the host behind a Linux box (Smoothwall), and assign it a private IP address.

Lets call:
tunnel-server-ip = the IP of the end of the tunnel the host is connecting to (on the internet)
real-ip = the real IP currently used by the host, that I want to assign to the Linux router
false-ip = the IP the host will get after it is put behind the Linux firewall

This is what I think I have to do for the tunnel to work:

  1. DNAT all incoming IP GRE packets on the external interface coming from the internet tunnel end, and send them to host. That is change the destination from real-ip to false-ip and send the packet to false-ip
  2. SNAT all incoming IP GRE packets coming on the internal interface coming from the host to appear they are generated by the Linux box and send them to the tunnel server. That is change the source field from false-ip to real-ip and send the packet to tunnel-server-ip

I came up with the following script:

tunnel_server_ip=217.x.x.x
false_ip=192.168.2.2
real_ip=82.x.x.x
/sbin/iptables -A PREROUTING -p 47 --src $tunnel_server_ip -j DNAT --to-destination $false_ip 
/sbin/iptables -A POSTROUTING -p 47 --src $false_ip -j SNAT --to-source $real_ip    
/sbin/iptables -A INPUT -p 47 -j ACCEPT

Running this results in No chain/target/match by that name. Could you please tell me what I did wrong? Am I on the right track?

share|improve this question
add comment

3 Answers

up vote 2 down vote accepted

You forgot the -t nat table switch in the PREROUTING/POSTROUTING instructions. Just add it at the front.

share|improve this answer
    
I had to leave the city, so I could not test this. But next week I will test what you said and give feedback. Please don't consider I forgot to accept a valid answer. –  andi Jul 10 '09 at 7:19
add comment

For most GRE tunnels you have to have a control protocol on TCP 1723. This has to be forwarded also. Here is a Link that describes the iptables configuration for this. You are on the right track, just missing the control protocol.

share|improve this answer
    
From what I gather, GRE itself has no dependency on communication over TCP 1723. However, PPTP uses a control protocol over TCP 1723 to negotiate setting up a separate GRE tunnel for the data traffic. –  Oskar Berggren Jul 12 '13 at 10:00
    
@Oskar, yes you are correct, GRE doesn't require it, but it's a connectionless protocol, so there needs to be some control channel to negotiate keys etc... –  Scott Lundberg Jul 12 '13 at 15:23
add comment

You appear to have forgotten to say "--table nat", so it's going into the filter table which doesn't have SNAT/DNAT targets, nor does it have PREROUTING and POSTROUTING chains.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.