Re: What happens after PREROUTING/nat ?

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

On Wednesday 07 of December 2011 18:57EN, Gáspár Lajos wrote:
> "A": the local router/gateway/firewall connected to the Internet and
> the LAN "B": a server on the LAN
> "C": a client on the same LAN or on the other side (Internet)
> If "C" connects from the Internet to a service on "A" (in reality the
> service is on "B") then everything is fine because I can DNAT the
> packets to "B"...
> But if "C" is in the LAN then the packets are simply disappearing...

They are not. If you monitor the LAN traffic, you should notice that the 
problem is not the redirected packet but the reply from B to C. Because 
B and C are in the same segment, the response goes directly to C (not 
through A) and its source address isn't translated back. Thus C sends a 
packet to A but gets response with source address of B (which it can't 
recognize). There are three usual solutions to this problem:

1. Don't put services accessible from outside into LAN, create a DMZ and 
put them there. Then the response will go through A and it will 
translate its source address.

2. Make clients from LAN use the real address of B rather than A. This 
is often done via views in BIND - you translate the name differently for 
clients in LAN and for the rest of the world.

3. When translating the destination address from A to B for packets 
coming from LAN, translate source address as well ("masquerade"). Then 
the reply will go back to A and it will translate both source and 
destination address. Awful? Definitely, but this is where all those 
masquerades got us...

                                                          Michal Kubeček

To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at

[Linux Netfilter Development]     [Linux Kernel Networking Development]     [Linux Networking Development]     [Linux Kernel Development]     [Linux Resources]     [LARTC]     [Bugtraq]     [Consulting]     [Free Internet Dating]     [Yosemite Forum]     [Photo]

Add to Google Powered by Linux