1

Thank you all in advanced!

So here is the situation:

1. domain0 has two NICs (LAN=enp1s0f0, WAN=enp1s0f1)
2. vm0 of domain0 has IP=10.4.4.10
3. ip_forward=1 AND all interfaces forwarding=1
4. PREROUTING WAN(dhcp from ISP) -->interface<-- DNAT to 10.4.4.10
5. PREROUTING WAN(dhcp from ISP) -->IP<-- DNAT to 10.4.4.10

The problem is !LAN! HTTP traffic to domain.com fails with (4) above.
And !LAN! HTTP traffic to domain.com succeeds with (5) above.

It would be nice to:

${IPTABLES} -t nat -A PREROUTING ${STATE_NEW_TCP} -p tcp -i ${if_WAN} --dport 80 -j DNAT --to-destination ${ip_VM0}:80

${IPTABLES} -t nat -A PREROUTING ${STATE_NEW_UDP} -p udp -i ${if_WAN} --dport 80 -j DNAT --to-destination ${ip_VM0}:80



But this only works:

MY_IP=22.22.222.22/24

${IPTABLES} -t nat -A PREROUTING ${STATE_NEW_TCP} -p tcp -d ${MY_IP} --dport 80 -j DNAT --to-destination ${ip_VM0}:80

${IPTABLES} -t nat -A PREROUTING ${STATE_NEW_UDP} -p udp -d ${MY_IP} --dport 80 -j DNAT --to-destination ${ip_VM0}:80


Q. What is the correct way to get !LAN traffic! to domain.com (website hosted on VM0)?
Currently iptables is PREROUTING DNAT forwarding from (dhcp assigned from ISP) WAN interface to virtual machine.
Any help appreciated. :)

Note: Using CentOS 7 (1611)

((RESULTS FILTERED)) = Providing only information related to question.

Chain INPUT (policy DROP 2 packets, 120 bytes) ((RESULTS FILTERED))
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     tcp  --  enp1s0f1 *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:80
    0     0 ACCEPT     udp  --  enp1s0f1 *       0.0.0.0/0            0.0.0.0/0            state NEW udp dpt:80
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            10.4.4.10            state NEW tcp dpt:80
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            10.4.4.10            state NEW udp dpt:80

Chain FORWARD (policy DROP 0 packets, 0 bytes) ((RESULTS FILTERED))
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     tcp  --  enp1s0f1 *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:80
    0     0 ACCEPT     udp  --  enp1s0f1 *       0.0.0.0/0            0.0.0.0/0            state NEW udp dpt:80
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            10.4.4.10            state NEW tcp dpt:80
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            10.4.4.10            state NEW udp dpt:80

Chain PREROUTING (policy ACCEPT 7 packets, 689 bytes) ((RESULTS FILTERED))
 pkts bytes target     prot opt in     out     source               destination
    0     0 DNAT       tcp  --  enp1s0f1 *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:80 to:10.4.4.10:80
    0     0 DNAT       udp  --  enp1s0f1 *       0.0.0.0/0            0.0.0.0/0            state NEW udp dpt:80 to:10.4.4.10:80
    1    60 DNAT       tcp  --  *      *       0.0.0.0/0            22.22.222.22         state NEW tcp dpt:80 to:10.4.4.10:80
    0     0 DNAT       udp  --  *      *       0.0.0.0/0            22.22.222.22         state NEW udp dpt:80 to:10.4.4.10:80

Chain POSTROUTING (policy ACCEPT 22181 packets, 1435K bytes)
 pkts bytes target     prot opt in     out     source               destination
 338K   73M MASQUERADE  all  --  *      enp1s0f1  10.2.2.0/24          0.0.0.0/0
16549 1086K MASQUERADE  all  --  *      enp1s0f1  10.4.4.0/24          0.0.0.0/0

domain0$ ip a ((RESULTS FILTERED))
2: enp1s0f0:  mtu 1500 qdisc mq state UP qlen 1000
    link/ether XX:XX:XX:XX:XX:XX brd ff:ff:ff:ff:ff:ff
    inet 10.2.2.1/24 brd 10.2.2.255 scope global enp1s0f0
       valid_lft forever preferred_lft forever
3: enp1s0f1:  mtu 1500 qdisc mq state UP qlen 1000
    link/ether XX:XX:XX:XX:XX:XX brd ff:ff:ff:ff:ff:ff
    inet 22.22.222.22/24 brd 255.255.255.255 scope global dynamic enp1s0f1
       valid_lft 87813sec preferred_lft 87813sec
4: xenbr0:  mtu 1500 qdisc noqueue state UP qlen 1000
    link/ether fe:ff:ff:ff:ff:ff brd ff:ff:ff:ff:ff:ff
    inet 10.4.4.1/24 brd 10.4.4.255 scope global xenbr0
       valid_lft forever preferred_lft forever
9: vm0-emu:  mtu 1500 qdisc pfifo_fast master xenbr0 state UNKNOWN qlen 1000
    link/ether fe:ff:ff:ff:ff:ff brd ff:ff:ff:ff:ff:ff
10: vm0:  mtu 1500 qdisc mq master xenbr0 state UP qlen 32
    link/ether fe:ff:ff:ff:ff:ff brd ff:ff:ff:ff:ff:ff

domain0$ brctl show
bridge name     bridge id               STP enabled     interfaces
xenbr0          8000.feffffffffff       no              vm0
                                                        vm0-emu

domain0$ cat /proc/sys/net/ipv4/ip_forward
1

domain0$ cat /proc/sys/net/ipv4/conf/*/forwarding ((RESULTS FILTERED))
1
1
1
1
1
1
1

domain0$ ls /proc/sys/net/ipv4/conf/ -l ((RESULTS FILTERED))
dr-xr-xr-x. 1 root root 0 May  2 15:31 all
dr-xr-xr-x. 1 root root 0 May  2 15:31 default
dr-xr-xr-x. 1 root root 0 May  2 18:08 vm0
dr-xr-xr-x. 1 root root 0 May  2 18:08 vm0-emu
dr-xr-xr-x. 1 root root 0 May  2 15:31 enp1s0f0
dr-xr-xr-x. 1 root root 0 May  2 15:31 enp1s0f1
dr-xr-xr-x. 1 root root 0 May  2 15:31 xenbr0

domain0$ uname -a ((RESULTS FILTERED))
Linux hostname 4.9.13-22.el7.x86_64 #1 SMP Sun Feb 26 22:15:59 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux

vm0$ ip a
2: eth0:  mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether xx:xx:xx:xx:xx:xx brd ff:ff:ff:ff:ff:ff
    inet 10.4.4.10/24 brd 10.4.4.255 scope global eth0
Improve this question
1
  • It should be noted that Internet to domain0's fqdn.com works but LAN traffic to fqdn.com does not.
    – user413477
    May 3, 2017 at 3:25

2 Answers 2

Reset to default
0

This is expected behaviour.

"-i ${if_WAN}" only matches packets that enter the box on the on the "WAN" interface. Packets from the LAN hosts don't enter on that interface so they never match the rule.

Unfortunately I don't think iptables can match on "packets destined for the ip address of ${if_WAN}" so you are stuck hardcoding your WAN IP in your iptables rules.

Improve this answer
0
-1

I doesn't seen any MASQUERADE entries in iptables config. Base on information that you provide, I assume, that you have enabled MASQUERADE on enp1s0f1 for LAN, but not enabled it for LAN network on enp1s0f0, that's why your NAT not work for WAN and not work for LAN.

Improve this answer
2
  • You are absolutly correct. It is being done though and it unintentionally got left out.
    – user413477
    May 27, 2017 at 0:10
  • original post has been updated.
    – user413477
    May 27, 2017 at 0:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.