iptables and snatting to different networks

Question

                linuxbox (p.q.r.t)
                    |
                    |
 INTERNAL  ------ ABCD ----- INTERNET
(p.q.r.s)                  (m.n.o.k)

ABCD has 3 interfaces connected to linuxbox, INTERNAL N/W, INTERNET.

Linuxbox has a private address (p.q.r.t). At present I am snatting the packets from linuxbox to INTERNET at ABCD.

I have a small doubt regarding the FTP from linuxbox since I have to support ftp from linuxbox to both INTERNAL N/W as well as in INTERNET.

How can I right a rule in iptables present in ABCD where it can decide if the destination ip-address of ftp server is within INTERNAL N/W or in INTERNET and do natting accordingly.

Answer 1

If linuxbox (p.q.r.t) and INTERNAL (p.q.r.s) are on the same subnet then you should not be hitting ABCD as it's really acting like a masquerading router in the scenario you described. I have to assume that forwarding is enabled on ABCD or you would not be hitting the internet from there, and I also have to assume that the proper routes are in place or your internal clients would not be getting traffic back.

What womble is saying is correct, but if this is cabled the way it should be, then ftp should work and if it doesn't your problem is probably not with ABCD. You can add iptables logging for specific traffic to see if ABCD is the problem, something like this:

iptables -A INPUT -p tcp -m tcp --destination-port 21 -j LOG --log-level 7 --log-prefix "FTP Testing"

You can of course limit the hosts that get traffic logged if you have a lot of FTP traffic on your network. Turn this off after your done because it can fill a log really fast.

Answer 2

If you want a machine to be on a different network segment, you should put it in a separate IP subnet -- that way normal routing works just fine. If that really can't be done, you can use a technique called "proxy ARP", where the gateway box ("ABCD") can pretend to be other machines on the network and respond to ARP requests on each other's behalf. I do not recommend this, though, unless you really know what you're doing, and you should just create separate subnets (it's not as though you've got a shortage of RFC1918 space to play with).

Answer 3

The NAT rule you need to set is a POSTROUTING rule (snat).

POSTROUTING means after rooting, so you can match only packet going to INTERNET because your routing tables already decided it.

Somethink like :

iptables -t nat -I POSTROUTING -o nameOfABCDInterfaceGoingToInternet -p tcp etc...

Answer 4

If ABCD is a specialized router/switch device then it should just work. Just plug in the internal network server to a spare port. If, however, ABCD is a server with multiple NICs (as it appears to be from your question) the then you will have to bridge the NICs together.

You will no longer have two NICs but only one bridge device in their place that will act as a single "NIC". Everything will appear to be in the p.q.r.0/24 network. Your firewall rules should be updated to reflect the new device (the bridge). If you need to restrict the traffic between the machines in INTERNAL and linuxbox then you need to write those rules. Keep in mind that FTP has two very different protocol schems you need to account for. As for communicating to INTERNET, you need only alter those rules already working for linuxbox to reflect the new device.

BTW, you should not pick your own p.q.r.0 network numbers. There is already a range specifically alloted for this type of use. The /16 network is 192.168.x.x and it seems like you should use it. Read up on it. The /16 network allows for 2^16 = 65,536 (minus two for router and broadcast address). 192.168.1/8 allows for about 256 hosts. There should be a rule that drops packets with RFC1918 source addresses.