LinuxQuestions.org
Support LQ: Use code LQ3 and save $3 on Domain Registration
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices



Reply
 
Search this Thread
Old 08-17-2009, 07:02 AM   #1
sjs_64
LQ Newbie
 
Registered: Aug 2009
Posts: 2

Rep: Reputation: 0
Is Iptable only doing symmetric NATing?


IPTABLE is only doing symmetric NATing even if other rules are written.

I have two interfaces eth0 and eth1 on my machine.


For example,


System X <------>| Network |<------->|(eth0) My System |
System Y <------>| Network |<------->|(eth1) My System (eth2)|<-----> Slave System A



System X - 192.168.1.158

System Y - 192.168.2.162



My System eth0 - 192.168.2.11 (connected with external network)

My System eth1 - 192.168.1.190 (connected with external network)

My System eth2 - 192.168.253.2 (connected directly with slave system A through internal network)



Slave system A - 192.168.253.3 is a slave device controlled by my system.



My system receives some packets on port 8000 on eth1 through system X. Its job is to convert its source ip and port and send it to system A. It does so by



iptables -t nat -I PREROUTING -i eth1 -p udp --dport 8000 -j DNAT --to-destination 192.168.253.3:8000

iptables -t nat -I POSTROUTING -0 eth2 -p udp --dport 8000 -j SNAT --to-destination 192.168.253.2:8000



My system also receives some packets on port 8004 on eth0 through system Y.
Its job is to convert its source ip and port and send it to system A. It does so by



iptables -t nat -I PREROUTING -i eth0 -p udp --dport 8004 -j DNAT --to-destination 192.168.253.3:8004

iptables -t nat -I POSTROUTING -0 eth2 -p udp --dport 8004 -j SNAT --to-destination 192.168.253.2:8004



System A is configured to process these packets and send back it to my system on eth2 with the same port from which it got packets.



Now what I want to do is to send packets received from system A with source port 8000 to external system Y

and send packets received from system A with source port 8004 to external system X.



Rule for it,

iptables -t nat -I PREROUTING -i eth2 -p udp --dport 8004 -j DNAT --to-destination 192.168.1.158:9000

iptables -t nat -I POSTROUTING -0 eth1 -p udp --dport 8004 -j SNAT --to-destination 192.168.1.190:8000

iptables -t nat -I PREROUTING -i eth0 -p udp --dport 8000 -j DNAT --to-destination 192.168.2.162:7000

iptables -t nat -I POSTROUTING -0 eth2 -p udp --dport 8000 -j SNAT --to-destination 192.168.2.11:8004






But as per my observations, last two DNAT-ed nad SNAT-ed rules are not applied. And my system is sending packets received on 8004 port of eth2 to 192.168.2.162:7000 and sending packets received on 8000 of eth0 to 192.168.1.158:9000.

Mean to say that it is doing totally reverse than what I need.



And as per observation, it is doing symmetric NATing on my packets because it is sending packets received from system A to the destination from which it got packets on port. E.g.

It receives packets on port 8000 of eth1 from system x(192.168.1.158:9000) and sends them from eth2(192.168.253.2:8000) to system A (192.168.253.3:8000).

So it is sending any packets received on port 8000 of eth2 from system A
(192.168.253.3:8000) to system x (192.168.1.158:9000) from where it got packets earlier.



I am using linux 2.6.22 on my board.

How to override this default behavior with my rules?
 
Old 08-21-2009, 01:41 PM   #2
TimothyEBaldwin
Member
 
Registered: Mar 2009
Posts: 249

Rep: Reputation: 27
The option "-0" makes no sense, you meant "-o". The option "--to-destination" makes no sense on a SNAT rule.

Also your SNAT rules need to match on packets as modified by the DNAT rules.

What do you mean by "symmetric NAT"? To stop apparent replies being natted I think you need to use the NOTRACK target.
 
  


Reply

Tags
iptable


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
what is an iptable? & how to seperate the network on the basis of iptable vinod.wagh Linux - Networking 1 09-11-2008 02:28 AM
Key Security: Symmetric Encrypting Individual Files mmmmtmmmm Linux - Security 4 12-30-2007 02:25 AM
CenOS 5 symmetric dual xeon 2.0 processors metallica1973 Red Hat 1 12-28-2007 06:21 AM
Recompiling for Symmetric Multiprocessing bmxcamel Linux - Hardware 4 04-10-2004 10:49 PM
how to enable SMP ( Symmetric MultiProcessing ) in Redhat Linux mahendaran_pv Linux - Software 0 10-17-2003 01:13 AM


All times are GMT -5. The time now is 03:47 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration