Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm trying to configure my computer as a gateway between two networks, but I cannot make it working for some reasons

Here is a representation of the network:

 192.168.1.101  192.168.1.102  192.168.1.103 ...
        |            |              |
        \------------+------+-------+--------...
                            |
                      192.168.1.200 (eth1)
                           PC
(192.168.2.101  192.168.2.102  192.168.2.103 ...)
     eth0:1        eth0:2         eth0:3
        |            |              |
        \------------+------+-------+--------...
                            |
                      192.168.2.200 (eth0)
                            |
                           ...

My computer has N virtual interfaces (eth0:*) with their own IP addresses on the interface 192.168.2.200 (eth0). I want that any connection (TCP mostly) that attack the eth0:* interfaces are forwarded to the equivalent 192.168.1.1** server.

I tryied using the redir executable but since servers use random port numbers for listening (cannot change this) I had to restart the processes everytime I made some tests.

So I used iptables rules like these (for only one server for testing):

iptables -t nat -A PREROUTING -d 192.168.2.101 -j DNAT --to-destination 192.168.1.101
iptables -t nat -A POSTROUTING -d 192.168.1.101 -j SNAT --to-source 192.168.2.101
iptables -A FORWARD -i 192.168.2.101 -d 192.168.1.101 -j ACCEPT

But any connection to 192.168.2.101:80 returns "Connection refused" while any connection to 192.168.1.101:80 is accepted.

Then I "played" with iptables rules without reseting the rules and I succeeded to connect to 192.168.2.101:80 which was actualy the right server ; but when I tried another connection (with a temp web server on TCP/6666), the connection has been rejected like above.

Do you have a full exemple to make it work please ?

Note: I removed every entries in iptables to do other tests, so I restarting from scratch without what I did before...

@lain: I enabled IP forwarding

$ cat /proc/sys/net/ipv4/ip_forward
1
share|improve this question
1  
Did you enable IPv4 forwarding? –  Iain Mar 25 at 14:49
    
my guess is that packets from 192.168.2.* are arriving at 192.168.1.* servers but they don't know how to reply back to the "2" network (no route, no forwarding). You can verify this by running tcpdump on a target server on the "1" network and checking if you see the requests and not the replies. –  LinuxDevOps Mar 25 at 15:52
    
Interfaces aliases are deprecated on Linux, stop using them. –  BatchyX Mar 25 at 16:16

1 Answer 1

iptables has a match that suits you: It's called NETMAP.

iptables -t nat -A PREROUTING -i eth0 --src 192.168.2.200/?? -j NETMAP --to 192.168.1.0/??
iptables -t nat -A PREROUTING -i eth1 --src 192.168.1.200/?? -j NETMAP --to 192.168.2.0/??

As for your interface aliases, ditch them. Not only are interface aliases deprecated (if you use ip addr, you will see that the kernel mapped them to its native functionality of having several addresses by interface), but it seems overkill here, as no local service uses them.

If you this host to answer ARP requests for those ip in eth0, use the ARP proxy feature or add a local route telling the kernel that all those IP are its own:

ip route add local 192.168.2.200/?? dev eth0
share|improve this answer
    
I like this answer, thank you ;) The thing is that the networks are 10.100.XX.YY/16 (instead of 192.168.2.xx) and the other one is 10.200.0-3.XX/22 (instead of 192.168.1.xx) ; Your solution does not work because I'm trying to "bind" 10.100.100-103.YY/16 to the coresponding 10.200.0-3.XX/22, do you think it's possible ? –  Wysiag Jul 21 at 13:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.