Hi list, I have aproblem originally posted to [EMAIL PROTECTED] maybe you guys can help me
---snip--- -------- Original Message -------- Subject: iptables problem with multible routes Date: Fri, 05 Jul 2002 12:10:07 +0200 From: "Uwe A. P. Wuerdinger" <[EMAIL PROTECTED]> Organization: X-tec Institute for Computer and network Security GmbH Newsgroups: mailinglist.debian.firewall Hi List, I have a problem with iptables (kernel 2.4.18) and multible routes. Setup: My Firewall (FW) has 3 interfaces eth0 = Internal eth1 = dedicatet router connection ppp0 (PPPoE DSL link on eth2) a kernel default route pointing to ppp0 an a second routingtable (me-prov) with an other default route pointing to the router connected to eth1. I have a NAT rule in place for MASQing the networks on eth0. For the nat Traffic I mark my packets that should use the me-prov defaulttable with a 0x1 # iptables -t mangle -I PREROUTING 1 -p tcp -i eth0 --dport 22 \ -j MARK --set-mark 0x01 works like expected. The packet gets NATed end send out to eth1. My problem is when I do the same for localy generated packets (e.g. the mailserver running on the FW) with # iptables -t mangle -I OUTPUT 1 -p tcp --dport 25 \ -j MARK --set-mark 0x01 The packed got routed out to eth1, as expected but has the Source IP of ppp0. What can I do to get that packets the right source IP for eth1? -------- Original Message -------- Subject: Re: iptables problem with multible routes Date: Fri, 05 Jul 2002 12:36:12 +0200 From: "Uwe A. P. Wuerdinger" <[EMAIL PROTECTED]> Organization: X-tec Institute for Computer and network Security GmbH Newsgroups: mailinglist.debian.firewall References: <[EMAIL PROTECTED]> <[EMAIL PROTECTED]> Jean Christophe ANDR�0/00 wrote: > [EMAIL PROTECTED] �crivait : > >>The packed got routed out to eth1, as expected but has the Source IP of >>ppp0. What can I do to get that packets the right source IP for eth1 >> > > Check your NAT rule: you probably need to precise the output interface as > "-o ppp0" to only NAT when it goes thought the DSL line. NOP that would break the NATing of the internal traffic that should go out to eth1: iptables -t mangle -I PREROUTING 4 -p tcp -i eth0 --dport 22 \ -j MARK --set-mark 0x01 ---snip--- greets Uwe -- X-Tec GmbH Institute for Computer and Network Security WWW : http://www.x-tec.de/
