Re: EBTables bridge for in/out internet access

ENP wrote:
> Hi,
> 
> This is what I'm planning:
> 
>                      +--------+             +--------------------------+
> provider <----> eth0 | bridge | eth1 <----> | http server with real ip |
>                      +--------+             +--------------------------+
>                         eth2
>                          ^
>                          |
>                      +--------+
>                      | host   |
>                      | without|
>                      | real   |
>                      | ip     |
>                      +--------+
> 
> I can't change any network settings on http server and can't get any
> other real ip address, but I need to:
> 
> 1) allow access to http server only for tcp/ip and port 80

I am not quite sure how specific you are wanting to be.  Are you saying that you want the server to be able to receive any TCP/IP traffic (and no UDP traffic) or any TCP/IP traffic that is only destined to port 80 (and possibly 443) (and no UDP traffic).  In other words could we ""hijack the IP that the http server is using for any and all ports save for port 80 which is being used for http traffic?  If this is indeed the case we will need to mindfull of some basic net traffic like DNS, ICMP, etc. that will need to go back and forth that originates from the server.  If we can get away with stealing the remaining ports from the IP we could then use them on the NATing router for the "hosts with out (a) real ip".

> 2) allow host without real ip to full as possible access to any other
> hosts (http server and internet hosts) with ip nat.

If we can find a way to utilize the IP of the http server as the IP for the NATing router this should not be a problem.  We will just have to make sure that the traffic that is destined to the IP that we are using really gets sent to the http server.  To accomplish this the traffic will need to be from a different IP so that the http server will not loose it's mind.  We could probably barrow a different IP on the same subnet or possibly (if you can) multihome the http server such that any traffic to it from the local clients will really use a different destination IP (DNAT and SNAT).

> I know that the best way is to use router for dnat (for http server) and
>  snat (for inner host without real ip address) but can't do this because
> I can't recofigure http server or reuse only one ip address in any other
> way.

Well you can but you really have to break things down and then fix them in such a way as to support what you are wanting to do.

> How can I create a configuration with bridge? Can anybody give me a
> sample configuration?

Give me some more information and I'll so my best.

> First task is more simple: I can use ebtables as iptables for dropping
> all packets except tcp/ip packets for source or destination port 80. But
> how can I masquerade inner host packets with http server mac and ip
> addrress for any host except http server? How can I connect to http
> server from inner host?
> 
> What another rules need I use with this:
> 
> iptables -t nat -A POSTROUTING -i eth2 -s $INNER_IP -j SNAT --to-source
> $REAL_IP
> ebtables -t nat -A POSTROUTING -i eth2 -s $INNER_MAC -j SNAT --to-source
> $REAL_MAC



Grant. . . .


-------------------------------------------------------
SF.Net email is sponsored by:
Tame your development challenges with Apache's Geronimo App Server. Download
it for free - -and be entered to win a 42" plasma tv or your very own
Sony(tm)PSP.  Click here to play: http://sourceforge.net/geronimo.php