LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 09-08-2014, 10:06 AM   #1
jimbo1954
Member
 
Registered: Oct 2006
Location: High Wycombe, Bucks, UK.
Distribution: Debian and Fedora Core in equal measure
Posts: 264

Rep: Reputation: 33
Converting IPTables entries to Cisco NAT/ACLs


I have a bunch of IPTables entries which I'm trying to convert to Cisco-style NATs or ACLs. I've got some of them sorted, but have some examples which I don't fully understand:

Quote:
-A POSTROUTING -s 10.11.12.41/32 -d ! 10.11.0.0/16 -j SNAT --to-source a.b.c.d
where 10.11.12.41/32 and 10.11.0.0/16 are RFC1918 addresses inside and a.b.c.d is the global address....Does this mean that anything with a source address of 10.11.12.41 and a destination in the range 10.11.0.0/16 should be natted on exit to have a destination address of a.b.c.d, or something else?

Quote:
-A PREROUTING -d c.e.f.g/32 -p tcp -m tcp --dport 4443 -m comment --comment "comment sanitised" -j DNAT --to-destination 10.5.11.1111:443
I think this is a Static NAT command that states any packet received in the outside interface with a destination IP address of c.e.f.g:4443 is translated to 10.5.11.111:4443 and sent from the inside interface

and could be replaced by the Cisco NAT command

Quote:
ip nat inside source static tcp 10.5.11.111 4443 c.e.f.g 4443
and finally:

Quote:
-A PREROUTING -s ! a.b.125.234/32 -d a.b.124.144/32 -p tcp -m tcp --dport 8880 -j DROP
Drop traffic with source a.b.25.34 and destination a.b.24.44/32 to destination port 8880


Obviously, all addresses sanitised and anonymous

Any clarification or suggestions welcome, I've googled till my fingers bleed but I'm not happy I fully understand
 
Old 09-09-2014, 02:50 AM   #2
es0teric
Member
 
Registered: Apr 2007
Distribution: Ubuntu
Posts: 105

Rep: Reputation: 19
Quote:
Originally Posted by jimbo1954 View Post
where 10.11.12.41/32 and 10.11.0.0/16 are RFC1918 addresses inside and a.b.c.d is the global address....Does this mean that anything with a source address of 10.11.12.41 and a destination in the range 10.11.0.0/16 should be natted on exit to have a destination address of a.b.c.d, or something else?
I believe that one means anything with a source IP of 10.11.12.41 and a destination IP not inside of 10.11.0.0/16 should have its source IP changed on egress to a.b.c.d
 
Old 09-09-2014, 06:19 AM   #3
jimbo1954
Member
 
Registered: Oct 2006
Location: High Wycombe, Bucks, UK.
Distribution: Debian and Fedora Core in equal measure
Posts: 264

Original Poster
Rep: Reputation: 33
Hi es0teric

You wrote:

Quote:
I believe that one means anything with a source IP of 10.11.12.41 and a destination IP not inside of 10.11.0.0/16 should have its source IP changed on egress to a.b.c.d
Is that because of the "!" in:

Quote:
-d ! 10.11.0.0/16
Appreciate your help, this is melting my brain!

Jim
 
Old 09-09-2014, 08:14 PM   #4
es0teric
Member
 
Registered: Apr 2007
Distribution: Ubuntu
Posts: 105

Rep: Reputation: 19
Yup, exactly.
 
  


Reply

Tags
iptables cisco


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
NAT rules through Cisco VPN CLient nicolas59000 Linux - Security 1 05-20-2014 03:36 AM
snmpttconvertmib fails on converting MIBs from Cisco, problem with OBJECT-TYPE? SebbJ Linux - Software 0 06-27-2012 10:06 AM
i am having trouble configuring my nat on a cisco 871 router anubis65656 Linux - Networking 9 03-06-2006 07:54 PM
Iptables Behind Cisco NAT djlightman Linux - Security 6 07-29-2003 02:28 PM
Linux or Cisco 678 NAT? salathe Linux - Networking 2 10-09-2001 10:10 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 08:24 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration