Masquerading between two Local Networks

acpi · 06-03-2003, 09:03 AM

Hello,

I'm trying to set up masquerading between two local networks, infact I've only three computers one of which is the gateway. I could set the ip-forwarding but how can I set up AND DETERMINE that there is a MASQUERADING running?
The clients are linux machines and are congured properly(gateway, dns).
The packet forwarding is working.
At the gateway side i try the following rules:
iptables -t nat -POSTROUTING -SNAT -s 192.168.2.0/24 --to 192.168.9.1
iptables -t nat -POSTROUTING -SNAT -s 192.168.9.0/24 --to 192.168.2.1
I'm using the netsniffer tcpdump to determine if there occurs masquerading, but it seems that it intercepts all the traffic in the networks ingnoring if there is masqerading or not.
Any help would be appreciated.

acpi

manthram · 06-03-2003, 09:29 AM

if you are sharing the internet connection and if you can ping out side network form the internal macines then you have ip masq

jharris · 06-03-2003, 09:40 AM

Quote:

Originally posted by acpi
iptables -t nat -POSTROUTING -SNAT -s 192.168.2.0/24 --to 192.168.9.1
iptables -t nat -POSTROUTING -SNAT -s 192.168.9.0/24 --to 192.168.2.1

Shouldn't this be

Code:

iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to 192.168.9.1
iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to 192.168.2.1

Where eth0 is 192.168.9.1 and eth1 is 192.168.2.1.

But - as these are both subnets with valid IPs whey are you using NAT instead of just forwarding the packets?

cheers

Jamie...

acpi · 06-04-2003, 03:40 AM

The exact rules are:
iptables -t nat -A POSTROUTING -j SNAT -s 192.168.2.0/24 --to 192.168.9.1
iptables -t nat -A POSTROUTING -j SNAT -s 192.168.9.0/24 --to 192.168.2.1
My goal ist to SHOW that MASQUERADING is actually taking place, otherwise masquerading is used for dialup and leased line connections, but once again I wanted to show the technology in action.

acpi

jharris · 06-04-2003, 03:56 AM

And if you use the lines I supplied what happens?

cheers

Jamie...

acpi · 06-05-2003, 07:09 AM

Well the strange thing is that I've masquerading up at home, but at the Uni with analogous configuration(2 end-compis and 1 GW), I can't make it to work.
And also at home, when the masquerading is in action i can ping only in the one direction, namely from the source(to be masqueraded) network to the destination(receiving masqueraded packets) network.

Best regards
acpi

jharris · 06-05-2003, 08:35 AM

Quote:

Originally posted by jharris
And if you use the lines I supplied what happens?

Quote:

Originally posted by acpi
And also at home, when the masquerading is in action i can ping only in the one direction, namely from the source(to be masqueraded) network to the destination(receiving masqueraded packets) network.

Thats correct. You can't ping the other was as whatever is behing the masquerader is hidden, and in most cases doesn't have a public IP address so there is no direct route to it anyway.

cheers

Jamie...