| View previous topic :: View next topic |
| Author |
Message |
wifiguy
Joined: 01 Feb 2010
Posts: 30
|
 Posted: Thu Feb 11, 2010 9:00 pm Post subject: How to tell if VLAN is not NAT'd |
 |
|
Hello all,
Right now I am sitting in a test environment. I have the WAN port on the ZS server statically assigned. We have a direct allocation from ARIN (American Registry for Internet Numbers), it's a /22 and it's our VLAN74.
Right now VLAN20, 30 and 70 are private VLANs and are NAT'd. I used the following IPtables to NAT them.
| Quote: |
iptables -t nat -I POSTROUTING 1 --src 172.30.0.0/16 -o eth1.20 -j MASQUERADE
iptables -t nat -I POSTROUTING 1 --src 192.168.1.0/24 -o eth1.30 -j MASQUERADE
iptables -t nat -I POSTROUTING 1 --src 152.93.0.0/16 -o eth1.70 -j MASQUERADE
|
VLAN74 should not be NAT'd, and from the above IP tables that should correct. However, when I put myself on VLAN74 I can gain access to the outside world. In the test environment that I am in right now, there is no route set up for this VLAN, so if this VLAN isn't being NAT'd, I should not be able to get to the outside world. Once this server is taken from our test lab and put into a production scenario, there will be routing on VLAN74 and outside access will be acheived.
But as it stands in the test environment that I am in, VLAN74 should not be able to get to get outside. This leads me to believe VLAN74 is also being NAT'd.
Is there a way to check this out on the server? From what I am seeing we are not doing anything that would make the server want to NAT'd vlan74.
Thoughts? |
|
| Back to top |
|
 |
ppalias
Joined: 17 Dec 2008
Posts: 1151
Location: Athens, Greece
|
| Posted: Fri Feb 12, 2010 7:49 am Post subject: |
|
|
1) Make sure eth1 is the wan interface.
2) Print here the output of | Code: | iptables -t nat -L -v
|
|
|
| Back to top |
|
|
wifiguy
Joined: 01 Feb 2010
Posts: 30
|
| Posted: Fri Feb 12, 2010 3:31 pm Post subject: |
|
|
| ppalias wrote: | 1) Make sure eth1 is the wan interface.
2) Print here the output of | Code: | iptables -t nat -L -v
|
|
Does Eth1 have to be the WAN port? Can it be Eth0? |
|
| Back to top |
|
|
Marcelo
Joined: 23 Jan 2010
Posts: 38
|
| Posted: Sat Feb 13, 2010 1:12 am Post subject: |
|
|
It can be ETH00. I actually use ETH00 as the WAN and ETH01 as LAN.
You just have to be careful as 99% of the examples shown here are the opposite, so you'll have to remember that...
Regads, |
|
| Back to top |
|
|
wifiguy
Joined: 01 Feb 2010
Posts: 30
|
| Posted: Sat Feb 13, 2010 2:35 pm Post subject: |
|
|
I'll run the above command from the server when I get back to the office on Monday.
Thanks all, |
|
| Back to top |
|
|
wifiguy
Joined: 01 Feb 2010
Posts: 30
|
| Posted: Mon Feb 15, 2010 4:41 pm Post subject: |
|
|
Alright, here is the output from the iptables -t nat -L -v command.
| Quote: |
root@fw root> iptables -t nat -L -v
Chain PREROUTING (policy ACCEPT 9173 packets, 1528K bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 40 packets, 3240 bytes)
pkts bytes target prot opt in out source destination
4134 311K SNATVS all -- any any anywhere anywhere
4098 308K MASQUERADE all -- any ETH00 anywhere anywhere
Chain OUTPUT (policy ACCEPT 3949 packets, 300K bytes)
pkts bytes target prot opt in out source destination
Chain SNATVS (1 references)
pkts bytes target prot opt in out source destination
|
*****Edit*****
Here are our pre-boot iptable commands. Just so you have them also. The below commands should not include vlan74 to be NAT'd correct?
| Quote: |
iptables -t nat -I POSTROUTING 1 --src 172.30.0.0/16 -o eth1.20 -j MASQUERADE
iptables -t nat -I POSTROUTING 1 --src 192.168.1.0/24 -o eth1.30 -j MASQUERADE
iptables -t nat -I POSTROUTING 1 --src 152.93.0.0/16 -o eth1.70 -j MASQUERADE
|
|
|
| Back to top |
|
|
ppalias
Joined: 17 Dec 2008
Posts: 1151
Location: Athens, Greece
|
| Posted: Tue Feb 16, 2010 9:52 am Post subject: |
|
|
| There is a huge mixup here. ZS is NATing everything going out of interface ETH00 and you are trying to NAT some VLANs on interface ETH01. Firstly make sure which interface is the outside and then remove the general NAT that ZS does on interface ETH00. |
|
| Back to top |
|
|
wifiguy
Joined: 01 Feb 2010
Posts: 30
|
| Posted: Tue Feb 16, 2010 2:43 pm Post subject: |
|
|
| ppalias wrote: | | There is a huge mixup here. ZS is NATing everything going out of interface ETH00 and you are trying to NAT some VLANs on interface ETH01. Firstly make sure which interface is the outside and then remove the general NAT that ZS does on interface ETH00. |
I guess I am confused on how to make ZS view my ETH00 as the wan port, and make ETH01, ETH01.20, ETH01.30 and ETH01.70 NAT'd behind ETH00, and how to make ETH01.74 and ETH01.90 not NAT'd......
How should my Router>NAT page look like? I have had ETH00 in the "NAT Enabled Interfaces", that's when everything appears to be NAT'd and I have had ETH01, ETH01.20, ETH01.30 and ETH01.70 in there leaving ETH00 out....
Not sure what I am doing wrong. |
|
| Back to top |
|
|
ppalias
Joined: 17 Dec 2008
Posts: 1151
Location: Athens, Greece
|
| Posted: Tue Feb 16, 2010 2:57 pm Post subject: |
|
|
| First of all which one is the WAN interface... |
|
| Back to top |
|
|
wifiguy
Joined: 01 Feb 2010
Posts: 30
|
| Posted: Tue Feb 16, 2010 2:57 pm Post subject: |
|
|
| ppalias wrote: | | First of all which one is the WAN interface... |
ETH00 |
|
| Back to top |
|
|
ppalias
Joined: 17 Dec 2008
Posts: 1151
Location: Athens, Greece
|
| Posted: Tue Feb 16, 2010 3:03 pm Post subject: |
|
|
Okay remove the ETH00 from the "NAT Enabled Interfaces". Then add a specific iptables command.
| Code: |
iptables -t nat -I POSTROUTING 1 --src 172.30.0.0/16 -o ETH00 -j MASQUERADE
iptables -t nat -I POSTROUTING 2 --src 192.168.1.0/24 -o ETH00 -j MASQUERADE
iptables -t nat -I POSTROUTING 3 --src 152.93.0.0/16 -o ETH00 -j MASQUERADE
|
|
|
| Back to top |
|
|
wifiguy
Joined: 01 Feb 2010
Posts: 30
|
| Posted: Tue Feb 16, 2010 7:17 pm Post subject: |
|
|
| ppalias wrote: | Okay remove the ETH00 from the "NAT Enabled Interfaces". Then add a specific iptables command.
| Code: |
iptables -t nat -I POSTROUTING 1 --src 172.30.0.0/16 -o ETH00 -j MASQUERADE
iptables -t nat -I POSTROUTING 2 --src 192.168.1.0/24 -o ETH00 -j MASQUERADE
iptables -t nat -I POSTROUTING 3 --src 152.93.0.0/16 -o ETH00 -j MASQUERADE
|
|
Ok. So I have tried this several ways.
Way 1:
Eth01, eth01.20, eth01.30 and eth01.70 in the NAT Enabled Interfaces with the following IP TAbles.
| Quote: |
iptables -t nat -I POSTROUTING 1 --src 172.30.0.0/16 -o ETH00 -j MASQUERADE
iptables -t nat -I POSTROUTING 2 --src 192.168.1.0/24 -o ETH00 -j MASQUERADE
iptables -t nat -I POSTROUTING 3 --src 152.93.0.0/16 -o ETH00 -j MASQUERADE
iptables -t nat -I POSTROUTING 1 --src 172.30.0.0/16 -o eth1.20 -j MASQUERADE
iptables -t nat -I POSTROUTING 1 --src 192.168.1.0/24 -o eth1.30 -j MASQUERADE
iptables -t nat -I POSTROUTING 1 --src 152.93.0.0/16 -o eth1.70 -j MASQUERADE
|
The iptables -t nat -L -v result is:
| Quote: |
root@fw root> iptables -t nat -L -v
Chain PREROUTING (policy ACCEPT 22 packets, 2606 bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 38 packets, 2966 bytes)
pkts bytes target prot opt in out source destination
37 3430 SNATVS all -- any any anywhere anywhere
3 704 MASQUERADE all -- any ETH01 anywhere anywhere
0 0 MASQUERADE all -- any ETH01.20 anywhere anywhere
0 0 MASQUERADE all -- any ETH01.30 anywhere anywhere
0 0 MASQUERADE all -- any ETH01.70 anywhere anywhere
Chain OUTPUT (policy ACCEPT 41 packets, 3670 bytes)
pkts bytes target prot opt in out source destination
Chain SNATVS (1 references)
pkts bytes target prot opt in out source destination
|
I also tried it with no interfaces in the Nat Enabled Interface using the following IP Tables:
| Quote: |
iptables -t nat -I POSTROUTING 1 --src 172.30.0.0/16 -o ETH00 -j MASQUERADE
iptables -t nat -I POSTROUTING 2 --src 192.168.1.0/24 -o ETH00 -j MASQUERADE
iptables -t nat -I POSTROUTING 3 --src 152.93.0.0/16 -o ETH00 -j MASQUERADE
|
The output iptables -t nat -L -v result
| Quote: |
root@fw root> iptables -t nat -L -v
Chain PREROUTING (policy ACCEPT 194 packets, 16902 bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 243 packets, 18350 bytes)
pkts bytes target prot opt in out source destination
0 0 MASQUERADE all -- any eth1.70 152.93.0.0/16 anywhere
0 0 MASQUERADE all -- any eth1.30 192.168.1.0/24 anywhere
0 0 MASQUERADE all -- any eth1.20 172.30.0.0/16 anywhere
0 0 MASQUERADE all -- any ETH00 172.30.0.0/16 anywhere
0 0 MASQUERADE all -- any ETH00 192.168.1.0/24 anywhere
0 0 MASQUERADE all -- any ETH00 152.93.0.0/16 anywhere
239 18110 SNATVS all -- any any anywhere anywhere
Chain OUTPUT (policy ACCEPT 70 packets, 5525 bytes)
pkts bytes target prot opt in out source destination
Chain SNATVS (1 references)
pkts bytes target prot opt in out source destination
|
eitherway, it appears as though it's not NAT'ing anything. I can't get out from behind interfaces eth01.20, 30, or 70 that are supposed to be NAT'd.
Thoughts? |
|
| Back to top |
|
|
ppalias
Joined: 17 Dec 2008
Posts: 1151
Location: Athens, Greece
|
| Posted: Tue Feb 16, 2010 8:04 pm Post subject: |
|
|
There seems to be something wrong with the interfaces you are using, as the iptables command is correct.
-t nat = apply this command in "nat" table.
-I POSTROUTING 1 = install this command in POSTROUTING chain in line 1
--src x.x.x.x/yy = the source IP is x.x.x.x/yy
-o ETH00 = the output interface is "ETH00"
-j MASQUERADE = masquerade the source IP with the IP of the interface ETH00 |
|
| Back to top |
|
|
wifiguy
Joined: 01 Feb 2010
Posts: 30
|
| Posted: Tue Feb 16, 2010 8:08 pm Post subject: |
|
|
| ppalias wrote: | There seems to be something wrong with the interfaces you are using, as the iptables command is correct.
-t nat = apply this command in "nat" table.
-I POSTROUTING 1 = install this command in POSTROUTING chain in line 1
--src x.x.x.x/yy = the source IP is x.x.x.x/yy
-o ETH00 = the output interface is "ETH00"
-j MASQUERADE = masquerade the source IP with the IP of the interface ETH00 |
How so? What would be wrong with the interfaces? |
|
| Back to top |
|
|
wifiguy
Joined: 01 Feb 2010
Posts: 30
|
| Posted: Tue Feb 16, 2010 8:23 pm Post subject: |
|
|
I am stumped.....We use this same config (minus the WAN IP) on a production router that we have, and all works well.
Anyway you would be willing to take a peek at our config file? |
|
| Back to top |
|
|
wifiguy
Joined: 01 Feb 2010
Posts: 30
|
| Posted: Tue Feb 16, 2010 8:56 pm Post subject: |
|
|
| The second I add ETH00 back to the NAT Enabled Interfaces, I can then ping the gateway, and get out to the outside. The only that worries me, is once behind our WAN port (in our test environment) I have no routing set up for vlan74 or 90, and right now those interfaces can also get out to the outside world....... |
|
| Back to top |
|
|
ppalias
Joined: 17 Dec 2008
Posts: 1151
Location: Athens, Greece
|
| Posted: Wed Feb 17, 2010 7:52 am Post subject: |
|
|
Yes I can take a peek at the config file.
Give me the output of |
|
| Back to top |
|
|
wifiguy
Joined: 01 Feb 2010
Posts: 30
|
| Posted: Wed Feb 17, 2010 2:47 pm Post subject: |
|
|
| ppalias wrote: | Yes I can take a peek at the config file.
Give me the output of |
Thanks, I sure appreciate it!
| Quote: |
root@fw root> ifconfig -a
DEFAULTBR Link encap:Ethernet HWaddr 32:3D:B4:0E:B0:76
BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
ETH00 Link encap:Ethernet HWaddr 00:1C:23:E1:53:3A
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:14517 errors:0 dropped:0 overruns:0 frame:0
TX packets:6022 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:2429059 (2.3 Mb) TX bytes:671540 (655.8 Kb)
Interrupt:16
ETH00:00 Link encap:Ethernet HWaddr 00:1C:23:E1:53:3A
inet addr:81.181.1.254 Bcast:81.181.255.255 Mask:255.255.0.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
Interrupt:16
ETH01 Link encap:Ethernet HWaddr 00:1C:23:E1:53:3B
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:13382 errors:0 dropped:0 overruns:0 frame:0
TX packets:34468 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1287156 (1.2 Mb) TX bytes:39614484 (37.7 Mb)
Interrupt:17
ETH01.20 Link encap:Ethernet HWaddr 00:1C:23:E1:53:3B
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
ETH01.20: Link encap:Ethernet HWaddr 00:1C:23:E1:53:3B
inet addr:172.30.0.1 Bcast:172.30.255.255 Mask:255.255.0.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
ETH01.30 Link encap:Ethernet HWaddr 00:1C:23:E1:53:3B
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:6 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 b) TX bytes:252 (252.0 b)
ETH01.30: Link encap:Ethernet HWaddr 00:1C:23:E1:53:3B
inet addr:192.168.1.1 Bcast:192.168.1.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
ETH01.70 Link encap:Ethernet HWaddr 00:1C:23:E1:53:3B
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
ETH01.70: Link encap:Ethernet HWaddr 00:1C:23:E1:53:3B
inet addr:152.93.0.1 Bcast:152.93.255.255 Mask:255.255.0.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
ETH01.74 Link encap:Ethernet HWaddr 00:1C:23:E1:53:3B
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:276 errors:0 dropped:0 overruns:0 frame:0
TX packets:355 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:28154 (27.4 Kb) TX bytes:99970 (97.6 Kb)
ETH01.74: Link encap:Ethernet HWaddr 00:1C:23:E1:53:3B
inet addr:74.116.16.1 Bcast:74.116.19.255 Mask:255.255.252.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
ETH01.90 Link encap:Ethernet HWaddr 00:1C:23:E1:53:3B
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:210 errors:0 dropped:0 overruns:0 frame:0
TX packets:132 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:16301 (15.9 Kb) TX bytes:12834 (12.5 Kb)
ETH01.90: Link encap:Ethernet HWaddr 00:1C:23:E1:53:3B
inet addr:206.10.124.128 Bcast:206.10.124.159 Mask:255.255.255.224
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
ETH01:00 Link encap:Ethernet HWaddr 00:1C:23:E1:53:3B
inet addr:10.0.0.1 Bcast:10.255.255.255 Mask:255.0.0.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
Interrupt:17
VPN99 Link encap:Ethernet HWaddr 00:FF:74:4A:11:BB
BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
dummy0 Link encap:Ethernet HWaddr 3E:5C:B4:5D:AB:E0
inet addr:192.168.141.142 Bcast:192.168.141.255 Mask:255.255.255.0
BROADCAST NOARP MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
dummy1 Link encap:Ethernet HWaddr 22:29:A6:79:AC:A8
inet addr:192.168.142.142 Bcast:192.168.142.255 Mask:255.255.255.255
UP BROADCAST RUNNING NOARP MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:346 errors:0 dropped:0 overruns:0 frame:0
TX packets:346 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:31403 (30.6 Kb) TX bytes:31403 (30.6 Kb)
root@fw root> exit
|
|
|
| Back to top |
|
|
ppalias
Joined: 17 Dec 2008
Posts: 1151
Location: Athens, Greece
|
| Posted: Thu Feb 18, 2010 8:28 am Post subject: |
|
|
ok first clear any entries
then insert the rules followed by the rule
| Code: | | iptables -t nat -I POSTROUTING 1 -i lo -o ETH00 -j MASQUERADE |
Try to ping, browser, fetch mails and then paste here the output of
| Code: | iptables -t nat -L -v
iptables -L -v
iptables -t mangle -L -v
traceroute www.yahoo.com
|
|
|
| Back to top |
|
|
wifiguy
Joined: 01 Feb 2010
Posts: 30
|
| Posted: Thu Feb 18, 2010 2:57 pm Post subject: |
|
|
| ppalias wrote: | ok first clear any entries
then insert the rules followed by the rule
| Code: | | iptables -t nat -I POSTROUTING 1 -i lo -o ETH00 -j MASQUERADE |
Try to ping, browser, fetch mails and then paste here the output of
| Code: | iptables -t nat -L -v
iptables -L -v
iptables -t mangle -L -v
traceroute www.yahoo.com
|
|
So, it would look something like this?
iptables -t nat -I POSTROUTING 1 --src 172.30.0.0/16 -o ETH00 -j MASQUERADE
iptables -t nat -I POSTROUTING 1 -i lo -o ETH00 -j MASQUERADE
iptables -t nat -I POSTROUTING 2 --src 192.168.1.0/24 -o ETH00 -j MASQUERADE
iptables -t nat -I POSTROUTING 2 -i lo -o ETH00 -j MASQUERADE
iptables -t nat -I POSTROUTING 3 --src 152.93.0.0/16 -o ETH00 -j MASQUERADE
iptables -t nat -I POSTROUTING 3 -i lo -o ETH00 -j MASQUERADE
Is that what you mean? |
|
| Back to top |
|
|
wifiguy
Joined: 01 Feb 2010
Posts: 30
|
| Posted: Thu Feb 18, 2010 4:01 pm Post subject: |
|
|
| We are getting you cannot use I with post routing error message. |
|
| Back to top |
|
|
ppalias
Joined: 17 Dec 2008
Posts: 1151
Location: Athens, Greece
|
| Posted: Fri Feb 19, 2010 8:12 am Post subject: |
|
|
Don't use | Code: | | iptables -t nat -I POSTROUTING 1 -i lo -o ETH00 -j MASQUERADE |
3 times.
If you still have a problem I will try to simulate it in my lab this weekend as it looks very weird to me. |
|
| Back to top |
|
|
wifiguy
Joined: 01 Feb 2010
Posts: 30
|
| Posted: Fri Mar 19, 2010 5:19 pm Post subject: |
|
|
| I still have not been able to get this to work. I would love to use this as our firewall, but so far I can't get certain VLAN's not to be NAT'd. |
|
| Back to top |
|
|
ppalias
Joined: 17 Dec 2008
Posts: 1151
Location: Athens, Greece
|
| Posted: Fri Mar 19, 2010 7:59 pm Post subject: |
|
|
| I admit that I totally neglected it, my apologies. I will find some time in the forthcoming weekend to do it. |
|
| Back to top |
|
|
wifiguy
Joined: 01 Feb 2010
Posts: 30
|
| Posted: Fri Mar 19, 2010 9:19 pm Post subject: |
|
|
| I appreciate this. Thank you! |
|
| Back to top |
|
|
ppalias
Joined: 17 Dec 2008
Posts: 1151
Location: Athens, Greece
|
| Posted: Sun Mar 21, 2010 11:14 pm Post subject: |
|
|
Okay good news.
I tried the scenario. It seems to be working fine for me.
[img]http://www.flickr.com/photos/35949154@N02/4451705013/[/img]
as you can see on the picture (or here if you cannot see it clearly) on the upper left window is the command I gave to ZS to allow only one subnet to NAT out of ETH00.
On the middle left window is the 2 pings I ran. The one towards 10.14.149.3 was initially not NATed and then I enabled NAT. You can see the change on the Wireshark window on the right. Source address changed from 192.168.20.2 (not NATed) to 10.14.149.25 (ETH00 address of ZS). On the lower left window is a tcpdump of another pc which accepted ping from the other VLAN of ZS, the 192.168.30.2 and it never changed it's source IP address.
So to conclude the iptables command is correct
| Code: | | iptables -t nat -I POSTROUTING --src 192.168.20.0/24 -o ETH00 -j MASQUERADE |
this ensures the 192.168.20.0/24 is NATed when goes out of ETH00 interface. Anything else goes out without NAT.
My iptables output on ZS is:
| Code: | root@zeroshell root> iptables -t nat -L -v
Chain PREROUTING (policy ACCEPT 374 packets, 53544 bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 171 packets, 14385 bytes)
pkts bytes target prot opt in out source destination
11 924 MASQUERADE all -- any ETH00 192.168.20.0/24 anywhere
171 14385 SNATVS all -- any any anywhere anywhere
Chain OUTPUT (policy ACCEPT 55 packets, 4641 bytes)
pkts bytes target prot opt in out source destination
Chain SNATVS (1 references)
pkts bytes target prot opt in out source destination |
|
|
| Back to top |
|
|
|
Search
Register
Usergroups
Profile
Log in
Private Message
