* Rerouting remote users to VPN channel
@ 2006-04-24 19:23 Ivan Gustin
2006-04-25 7:56 ` Matt Barclay
0 siblings, 1 reply; 3+ messages in thread
From: Ivan Gustin @ 2006-04-24 19:23 UTC (permalink / raw)
To: netfilter
Hi,
I have one specific routing situation that I still can't handle, so I am
asking for some help.
I have Linux server, one eth interface and 2 DSL links. One DSL is VPN
link to another site's Web Intranet application. VPN link itself is
realised via DSL line and CISCO router. Local users can work with that
application. Another DSL is Internet gateway for local users, and
incomming channel for accessing server from outside (there is Siemens
DSL router).
I want to provide that external remote users can connect to that server
from Internet and use that Intranet application via another DSL and VPN
channel.
Route table:
# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use
Iface
192.168.30.9 192.168.93.65 255.255.255.255 UGH 0 0
0 eth0
192.168.93.64 0.0.0.0 255.255.255.192 U 0 0 0
eth0
127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo
0.0.0.0 192.168.93.122 0.0.0.0 UG 0 0 0
eth0
...93.64/26 is LAN,
...93.65 is VPN gateway to Intranet Web server on another site,
...93.122 is Internet gateway,
...30.9 is Intranet Web server with The Application on remote site.
Local users can go to Internet and on Intranet app on remote site, and
that works fine. I need rules that Internet users comming from public IP
using http://mysite.dyndns.biz:myport through ...93.122 can go to
http://192.168.30.9:80. I succesfully set forwarding on DSL router so
incomming packets comes to server on port 'myport' (I can't
reroute/rewrite packets on DSL router itself).
I tried with one PREROUTING rule, but I can't rewrite both source and
destination address, so obviusly I need two rules?
Thank anyone for any help,
GI
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: Rerouting remote users to VPN channel
2006-04-24 19:23 Rerouting remote users to VPN channel Ivan Gustin
@ 2006-04-25 7:56 ` Matt Barclay
2006-04-25 8:21 ` Ivan Gustin
0 siblings, 1 reply; 3+ messages in thread
From: Matt Barclay @ 2006-04-25 7:56 UTC (permalink / raw)
To: ivan.gustin; +Cc: netfilter
Hi Ivan,
Yes, you need SNAT and DNAT rules. Something like this ought to work
(note: this should be on your Internet Gateway's Firewall, otherwise
you have to forward port 80 traffic from the Gateway to your linux
server. You are running linux on your internet gateway, right? ;)
iptables -t mangle -A PREROUTING -d <yourPublicIP> -p tcp --dport 80
-j MARK --set-mark 80
iptables -t nat -A PREROUTING -m mark --mark 80 -j DNAT --to 192.168.30.9
iptables -A FORWARD -m mark --mark 80 -j ACCEPT
iptables -t nat -A POSTROUTING -m mark --mark 80 -j SNAT --to
<firewallPrivateIP>
assumes the internet gateway has a route to 192.168.30.9
If you have to run this on a different linux machine, replace
<yourPublicIP> with <firewallPrivateIP>
If this doesn't work or doesn't make sense, be sure to post a network
diagram in your email.
Good Luck,
Matt
On 4/24/06, Ivan Gustin <ivan.gustin@pu.t-com.hr> wrote:
> Hi,
>
> I have one specific routing situation that I still can't handle, so I am
> asking for some help.
>
> I have Linux server, one eth interface and 2 DSL links. One DSL is VPN
> link to another site's Web Intranet application. VPN link itself is
> realised via DSL line and CISCO router. Local users can work with that
> application. Another DSL is Internet gateway for local users, and
> incomming channel for accessing server from outside (there is Siemens
> DSL router).
>
> I want to provide that external remote users can connect to that server
> from Internet and use that Intranet application via another DSL and VPN
> channel.
>
> Route table:
> # route -n
> Kernel IP routing table
> Destination Gateway Genmask Flags Metric Ref Use
> Iface
> 192.168.30.9 192.168.93.65 255.255.255.255 UGH 0 0
> 0 eth0
> 192.168.93.64 0.0.0.0 255.255.255.192 U 0 0 0
> eth0
> 127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo
> 0.0.0.0 192.168.93.122 0.0.0.0 UG 0 0 0
> eth0
>
> ...93.64/26 is LAN,
> ...93.65 is VPN gateway to Intranet Web server on another site,
> ...93.122 is Internet gateway,
> ...30.9 is Intranet Web server with The Application on remote site.
>
> Local users can go to Internet and on Intranet app on remote site, and
> that works fine. I need rules that Internet users comming from public IP
> using http://mysite.dyndns.biz:myport through ...93.122 can go to
> http://192.168.30.9:80. I succesfully set forwarding on DSL router so
> incomming packets comes to server on port 'myport' (I can't
> reroute/rewrite packets on DSL router itself).
>
> I tried with one PREROUTING rule, but I can't rewrite both source and
> destination address, so obviusly I need two rules?
>
> Thank anyone for any help,
> GI
>
>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: Rerouting remote users to VPN channel
2006-04-25 7:56 ` Matt Barclay
@ 2006-04-25 8:21 ` Ivan Gustin
0 siblings, 0 replies; 3+ messages in thread
From: Ivan Gustin @ 2006-04-25 8:21 UTC (permalink / raw)
To: Matt Barclay; +Cc: netfilter
Matt Barclay:
> Yes, you need SNAT and DNAT rules. Something like this ought to work
Thank you, Matt, for answering.
> iptables -t mangle -A PREROUTING -d <yourPublicIP> -p tcp --dport 80
> -j MARK --set-mark 80
> iptables -t nat -A PREROUTING -m mark --mark 80 -j DNAT --to 192.168.30.9
> iptables -A FORWARD -m mark --mark 80 -j ACCEPT
> iptables -t nat -A POSTROUTING -m mark --mark 80 -j SNAT --to
> <firewallPrivateIP>
Yes, I set up something like this few hours ago, and it worked. But,
unfortunately, Intranet Web application uses absolute private IP
addresses, so that can't work. Application starts, but when user clicks
on some option connection hangs trying to open http://192.168.30.9/....
:-( I can't change third-party Web app.
I don't see any other solution but setting up VPN so users have private
routeable IP addresses.
Thanks anyway.
GI
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2006-04-25 8:21 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2006-04-24 19:23 Rerouting remote users to VPN channel Ivan Gustin
2006-04-25 7:56 ` Matt Barclay
2006-04-25 8:21 ` Ivan Gustin
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.