Home » forums » Imported debian.org Mailing Lists » Debian ISP

iptables masquerading

Tags:

Jim Popovitch wrote:
> (my fav linux list is missing in action... so I'm trying here)
>
> What am I doing wrong.... :-)
>
> ifconfig tap0 192.168.1.1 netmask 255.255.255.0 up
> iptables -A FORWARD -i eth0 -o tap0 -m state --state
> ESTABLISHED,RELATED -j ACCEPT;
> iptables -A FORWARD -i tap0 -o eth0 -j ACCEPT;
> iptables -t nat -A POSTROUTING -s 192.168.1.0 -o eth0 -j MASQUERADE;
>
>>From a PC at 192.168.1.2 I can ping 192.168.1.1 over the vpn
> (OpenVPN), but when I try to ping/telnet through the vpn I get
> nowhere. When doing the following from 192.168.1.2:
>
> telnet www.testing.com 80
>
>
> on 192.168.1.1 I see this:
>
> $ tcpdump -i any host www.testing.com
> tcpdump: WARNING: Promiscuous mode not supported on the "any" device
> tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
> listening on any, link-type LINUX_SLL (Linux cooked), capture size 96 bytes
> 00:12:49.535229 arp who-has papyrus.kattare.com tell 192.168.1.2
> 00:12:50.535768 arp who-has papyrus.kattare.com tell 192.168.1.2
> 00:12:51.535862 arp who-has papyrus.kattare.com tell 192.168.1.2
>
> BTW, papyrus.kattare.com is aka www.testing.com
>
> Tia,

Just in case: did you check that forwarding is activated in
/proc/sys/net/ipv4/ip_forward ? Do a cat of the file, check it has 1, if
not then configure it for next boot (best is to configure it using
/etc/sysctl.conf).

Thomas

--

Bookmark/Search this post with:
  • Delicious
  • Digg
  • StumbleUpon
  • Propeller
  • Reddit
  • Magnoliacom
  • Newsvine
  • Furl
  • Google
  • Yahoo
  • Technorati
No votes yet
‹ DMVPN on Etch apache 'deny from' vs iptables ›

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

iptables masquerading

Submitted by Damian Ryszka on Mon, 2008-02-04 03:00.

Dnia Sun, 3 Feb 2008 21:37:52 -0800
"Jim Popovitch" napisał(a):

> iptables -t nat -A POSTROUTING -s 192.168.1.0 -o eth0 -j MASQUERADE;

You don't need to place here netmask ?

--
Damian Ryszka aka Rychu
rychu(at)sileman.net.pl

»

iptables masquerading

Submitted by Stephen Gran on Mon, 2008-02-04 08:00.

This one time, at band camp, Jim Popovitch said:
> (my fav linux list is missing in action... so I'm trying here)
>
> What am I doing wrong.... :-)
>
> ifconfig tap0 192.168.1.1 netmask 255.255.255.0 up
> iptables -A FORWARD -i eth0 -o tap0 -m state --state ESTABLISHED,RELATED -j ACCEPT;

Reply traffic is forwarded from eth0 to tap0.

> iptables -A FORWARD -i tap0 -o eth0 -j ACCEPT;

Inbound traffic on tap0 is accepted if it exits eth0.

> iptables -t nat -A POSTROUTING -s 192.168.1.0 -o eth0 -j MASQUERADE;

And traffic out eth0 is NAT'ted (wrongly - note the missing netmask)

So, I'm assuming that your network is something like:

---------- ----------- ------------
| LAN | | Router | | VPN LAN |
---------- ----------- ------------
\eth0/ \tap0/

and you want to route traffic from LAN to VPN LAN.

You need to accept traffic coming in eth0 and exiting tap0. You
currently only accept reply traffic.

You'll need to accept at least reply traffic coming in tap0 and exiting
eth0. You currently accept all traffic, so this works.

You'll find it easier to NAT traffic going out tap0 (SNAT instead of
DNAT).
--
-----------------------------------------------------------------
| ,''`. Stephen Gran |
| : :' : |
| `. `' Debian user, admin, and developer |
| `- http://www.debian.org |
-----------------------------------------------------------------

»
Syndicate content