I posted previously on this list regarding some problems with NAT. I want
to thank everyone who helped, especially Paolo Lucente who provided some
useful hints. I still haven't gotten ipnat to work, but I now know that
packets do reach their destination on the outside network but aren't
mapped back to the source.
Here is what "ipnat -vl" says:
List of active MAP/Redirect filters:
map tu1 192.168.1.0/24 -> 0.0.0.0/32 proxy port ftp ftp/tcp
map tu1 192.168.1.0/24 -> 0.0.0.0/32 portmap tcp/udp 40000:60000
map tu1 192.168.1.0/24 -> 0.0.0.0/32
List of active sessions:
MAP 192.168.1.3 <- -> <tu1-external-IP> [<dest-IP>]
age 4740 use 0 sumd 0/0 pr 1 bkt 8/65 flags 8
ifp tu1 bytes 28800 pkts 480
List of active host mappings:
192.168.1.3,<dest-IP> -> 0.0.0.0 (use = 1 hv = 28)
I also tried bimap, with some interesting results:
# ipnat -vl
List of active MAP/Redirect filters:
bimap tu1 192.168.1.3/32 -> <tu1-external-IP2>/32
List of active sessions:
BIMAP 0.0.2.128 <- -> <tu1-external-IP2> [dest-IP]
age 3684 use 0 sumd 0/0 pr 1 bkt 31/4 flags 8
ifp tu1 bytes 336 pkts 4
List of active host mappings:
192.168.1.3,<dest-IP> -> <tu1-external-IP2> (use = 2 hv = 28)
192.168.1.3,<dest-IP> -> <tu1-external-IP2> (use = 2 hv = 28)
The result was the same: packets got mapped to a new address on their way
out, reached the destination, but didn't get mapped back to their original
source address. I find the "BIMAP 0.0.2.128" rather curious.
The problem with static routing and gated I mentioned in the original
posting was due to the fact that both the outside and inside network were
in the same subnet, thus no routing can take place.
- Marko
My original problem:
> We have a small address space with netmask 255.255.255.248. This leaves us
> only 5 usable IP addresses, so I'm trying to set up ipnat to map the
> addresses in a larger internal network into this range. I started with the
> following ruleset:
> map tu1 192.168.1.0/24 -> 0.0.0.0/32 proxy port ftp ftp/tcp
> map tu1 192.168.1.0/24 -> 0.0.0.0/32 portmap tcp/udp 40000:60000
> map tu1 192.168.1.0/24 -> 0.0.0.0/32
>
> None of the machines in the intenal network could access the external
> network, even though 'ipnat -l' shows mappings for connections to the
> external nameservers. I then tried to get one of the machines in the
> internal network to be visible in the external network by replacing the
> ruleset with just one rule:
> bimap tu1 192.168.1.2 -> x.x.x.x/32
>
> Again, the gateway sees both networks as expected and 'ipnat -l' shows
> active mappings but nothing gets through either way. Is the machine in the
> internal network expected to answer to 'ping x.x.x.x' from the external
> network (are the ICMP packets forwarded)? I'm not sure whether the problem
> lies in ipnat or somewhere else as I was unable to get any routing done
> with gated either. The gateway is running IPFilter v4.0alpha25 on Tru64
> UNIX V5.1A.
--
Marko Havu + <Marko.Havu@ + "Against stupidity,
Keskustie 24 B 27 + havutuote.fi> + the Gods themselves
FIN-40100 Jyv�skyl� + + contend in vain"
Finland + +358 40 7435 380 + - Johann Wolfgang von Goethe
