Christian Parpart wrote:
> Hi,
>
> we're about to move some services from an old host to a newer one,
> however, we want to keep up the old host for a week after the migration, so,
> that everyone may choose their own good time to switch their IP's in their
> local configs.
>
> that is, I want to all IP packets incoming at $old_ip to be redirected to
> $new_ip via iptables.
>
> unfortunately, in my little test, that didn't work '(
>
> Executing the following on the $old_ip's host.
>
> $ old_ip=public.ip.1
> $ new_ip=public.ip.2
>
> $ iptables -t nat -A PREROUTING -p tcp --dport 81 \
> -d $old_ip -i eth0 -j DNAT --to-destination $new_ip:80
> $ iptables -t nat -A POSTROUTING -p tcp --sport 80 -\
> s $new_ip -o eth0 -j SNAT --to-source $old_ip:81
Try adding these and report success :-)
$ iptables -t filter -I FORWARD -p tcp \
-d $old_ip --dport 81 -j ACCEPT
$ iptables -t filter -I FORWARD -p tcp \
-s $new_ip --sport 80 -j ACCEPT
Check if you neeed -i/o eth0.
The general way to debug iptables for me is to add the same rule with
-j LOG instead and then run this:
watch -n1 -d 'for f in nat filter mangle; do echo -e "\n\n\t\tFILTER: $f\n";
iptables -t $f -L -nxv --line-numbers; done'
or
watch -n1 -d 'for f in nat filter mangle; do echo -e "\n\n\t\tFILTER: $f\n";
iptables -t $f -L -nxv --line-numbers; done |grep LOG'
or
watch -n1 -d 'for f in nat filter mangle; do echo -ne "\n\n:::\t$f\t:::\n";
iptables -t $f -L -nxv --line-numbers; done | egrep --after 1 "LOG|^Chain "'
(Hmm, I am sending that for GWN Tips&Tricks!)
> now, a $(telnet $old_ip:81) shall be equivalent to $(telnet $new_ip:80).
> but it seems that no packet is reaching the $new_ip's host.
>
> So has anybody a nice hint for me where I ran into what pitfall?
Your pitfall is very common: "not enough RTFM-ing" :-)
Excerpt from:
http://www.netfilter.org/documentation/HOWTO/netfilter-hacking-HOWTO-3.html
=cut
On the left is where packets come in: having passed the simple sanity
checks (i.e., not truncated, IP checksum OK, not a promiscuous receive),
they are passed to the netfilter framework's NF_IP_PRE_ROUTING [1] hook.
Next they enter the routing code, which decides whether the packet is
destined for another interface, or a local process. The routing code may
drop packets that are unroutable.
If it's destined to pass to another interface instead, the netfilter
framework is called for the NF_IP_FORWARD [3] hook.
=cut
/me tries to contribute my 2 yen.
Kalin.
--
|[ ~~~~~~~~~~~~~~~~~~~~~~ ]|
+-> http://ThinRope.net/ <-+
|[ ______________________ ]|
--
[email protected] mailing list
