Re: DNATing packets travelling over a bridge

On 7/4/2007 9:48 AM, Mike Milner wrote:
> I have a transparent firewall to the internet setup using ebtables 
> with a transparent bridge between two ethernet interfaces.  Neither 
> of the two interfaces nor the bridge have an IP address assigned.

I have to ask.  Are you doing any layer 3 modification of the traffic 
that you are bridging / firewalling or are you doing simple filtering of 
traffic on layer 2?

> I am adding a third network card to the firewall that will be 
> connected directly to another computer.  The third network card and 
> the other computer will be on a subnetwork of their own (not part of 
> the bridge)

Ok...

> What I would like to do is redirect some of the outgoing firewall 
> traffic to the other computer without the internal clients having any 
> configuration changes.

Ok...

> My first idea of the setup:
> 
> REDIRECT_IP=1.2.3.4
> INTERNAL_IP=192.168.0.10
> 
> iptables -t nat -A PREROUTING -d $REDIRECT_IP -j DNAT 
> --to-destination $INTERNAL_IP

I think that you would be better off using EBTables to alter the 
traffic.  IPTables is going to alter the target IP and I'm not sure that 
you need and / or want to do this.  See below for my alternate proposal.

> This way any packet coming from the internal LAN destined for 1.2.3.4 
> will transparently be redirected to my second computer running on 
> 192.168.0.10.

Yes, however the destination IP in the traffic will be altered.  I don't 
know if this will be a problem or not.  However I think you could 
accomplish what you are wanting to do slightly differently.

> I also want the response packet's source address to be re-written to 
> 1.2.3.4 so the client doesn't need to know that the IP was 
> redirected.

The fact that you have to deal with a source IP that was not the 
original destination IP is part of the reason why I think you do not 
want to do this this way.

> Will this work on a transparent bridge setup?

Possibly.

Consider a different solution that I think will accomplish what you are 
wanting to do (IMHO) much easier and a little bit cleaner.

Add your third network card and additional target computer to the 
existing bridge and use EBTables to redirect traffic on layer 2 to the 
additional target computers MAC address leaving the destination IP 
address in tact.

All you would need to do on the additional target computer is to have it 
respond as the target IP in question.  This only leaves a situation 
where the additional target computer has to know how to get traffic back 
to the original client.

I'd say the easiest way to get the traffic from the additional target 
computer back to the original source computer would be to have the 
additional target computers default gateway either be the bridge its 
self or reachable through the bridge.  This way you can use the same 
method that was used to get the traffic from the original source 
computer to the additional target computer back from the additional 
target computer to the original source computer.

Consider this hypothetical layout:

                                   :
                 |                 :
          +------+------+          :
          | aa.bb.cc.dd |          :
          |   Router    |          :
          | 11.22.33.44 |          :
          +------+------+          :
                 |                 :
            +----+---+             :
            | Bridge +----------------------+
            +----+---+             :        |
                 |                 :        |
      +----------+----------+      :        |
      |       Switch        |      :        |
      +-+-----------------+-+      :        |
        |                 |        :        |
+------+------+   +------+------+ : +------+------+
| 11.22.33.55 |   | 11.22.33.88 | : | 99.88.77.66 |
+-------------+   +-------------+ : +-------------+
                                   :

Let's say that 11.22.33.55 is the original source computer and that we 
want to redirect any traffic to 99.88.77.66 over to the additional 
target computer.  Normally any traffic from 11.22.33.55 to 99.88.77.66 
would be routed out through the default router 11.22.33.44 out to the 
world.  However the bridge can intercept the traffic to 99.88.77.66 and 
layer 2 DNAT the traffic to the MAC address of 99.88.77.66 thus causing 
the traffic to be bridged over to the additional new computer.

Returning traffic from 99.88.77.66 to 11.22.33.55 would be routed out 
through the additional target computers default route.  As long as the 
additional target computer can reach its default route through the 
bridge, either the bridge can be the default route or the upstream 
router can be the default route, the bridge can then layer 2 DNAT the 
traffic to the MAC address of 11.22.33.55 thus causing the traffic to be 
bridged over to the original source computer.

Thus yielding a completely bridged solution that does not need to alter 
layer 3 IP addresses at all.

If you make the bridge be the default route for the additional target 
computer this could be a completely transparent drop in replacement that 
would not require any thing special any where other than the bridge its 
self.  Thus your additional target computer could be any IP device, not 
just a Linux computer that has the ability to alter its own packets.



Grant. . . .

-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/