Re: nat redirect-to
Phil Whineray <[email protected]>
| Newsgroups | gmane.comp.security.firewalls.firehol.user |
|---|---|
| Message-ID | <20120905205647.GA6007@pdw-compaq> |
Hi On Wed, Sep 05, 2012 at 10:58:10AM -0400, Tony Peña wrote: > i try to put this into my server with old-radius to can redirect all thouse > packages to back a new server version > and the syntaxs is ok because firehol try works fine.. but i see in the old > server continues packages comming as nothing happend.. So you are trying to write a firehol config to refirect traffic coming in to the client and make it go to a different machine? I don't think you can do that with redirect-to; it only redirects to a new port on the local machine. > now my problem. [snip] I filled in the blanks and used this as a complete config: version 5 NAS_IPS="10.0.0.1 10.0.0.2" NEWIP=10.0.0.99 nat redirect-to 1812 inface eth0 src "$NAS_IPS" proto udp $NEWIP dport 1812 nat redirect-to 1813 inface eth0 src "$NAS_IPS" proto udp $NEWIP dport 1813 interface eth0 inet policy drop client all accept However I get two syntax errors which look like this: ERROR #: 1 WHAT : Creating chain 'nat.1' under 'PREROUTING' in table 'nat' WHY : Cannot understand directive '10.0.0.99'. COMMAND: nat redirect-to 1812 inface eth0 src 10.0.0.1\ 10.0.0.2 proto udp 10.0.0.99 dport 1812 SOURCE : line 6 of x.conf > and nothing happens,.. > remember 1812 is for autorization/authentication and 1813 is accounting. so > need redirecto both ports to new server. Are you sure you are loading the rules? You could try "firehol status" to look at the generated iptables, but I don't think the syntax is correct or that the command you are using is right. "nat to-destination" may do what you want. I think you will need to define a router also. I gave the below a quick test (using netcat, since I don't have any radius servers to hand): version 5 NAS_IPS="10.0.0.1 10.0.0.2" NEWIP=10.0.0.99 nat to-destination $NEWIP inface eth0 src "$NAS_IPS" proto udp dport 1812 nat to-destination $NEWIP inface eth0 src "$NAS_IPS" proto udp dport 1813 interface eth0 inet policy drop client all accept router redirector inface eth0 outface eth0 route radius accept Hope that helps somewhat Phil ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/