Re: Xen, ebtables and iptables problem
"Passera, Pablo R" <[email protected]> Thu, 27 Sep 2007 13:41:49 -0700
| Newsgroups | gmane.linux.network.bridge.ebtables.user |
|---|---|
| Message-ID | <693C77BB4547254F8298DD853359C44A08563C@FMSMSX420> |
Some more info... >Do you have Bridge Net Filter option turned on in the kernel? Yes, I have it >You have a 10.230.40.85 IP address listed in your >IPTables rule, but I'm not sure where that system is and how it may or >may not correlate to your IPTables rule. Actually, the rule in the iptables is: iptables -t nat -A PREROUTING -i eth0 -s 192.168.1.3 -p tcp --dport 80 -j REDIRECT --to-port 3128 10.230.40.85 is incorrect. >Now, with out knowing example source / destination IP addresses, I can't >say for sure what will happen with the traffic... I am trying to redirect web pages requests generated by PC1 to the port 3128 in Router2 (there is an squid there). So, the destination IP would be "web page IP" and the source is 192.168.1.3 Other thing that I've noticed is that if I drop every packet as default policy in the PREROUTING chain (i.e. iptables -t nat -P PREROUTING DROP), the packet is not sent. So, in some way the packet is going through the PREROUTING chain, but I cannot catch it when the target is REDIRECT. Does this tell you something else? Thanks, Pablo >-----Original Message----- >From: ebtables-user-bounces-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org [mailto:ebtables-user- >[email protected]] On Behalf Of Grant Taylor >Sent: Thursday, September 27, 2007 5:08 PM >To: Mail List - EBTables >Subject: Re: [Ebtables-user] Xen, ebtables and iptables problem > >On 09/27/07 11:04, Passera, Pablo R wrote: >> Hi all, >> >> I have the following network configuration >> Dom0 >> --------------------------- >> | Router2 192.168.1.2 | >> | 00:16:41:55:A5:8C | >> | eth0 | >> _________ | | | >> / \ | |-----------|------| | >> 192.168.1.1 | Network | | | vif0.0 | | >> Router1 ----| |-------| peth0 | | Dom1 >> \_________/ | | vif1.0------eth1 PC1 >> | |__________________| | 192.168.1.3 >> | Xenbr0 bridge | >> --------------------------- >> >> PC1 default gateway is router1. The idea is to route PC1 packets >> through router1 without modifying PC1 network configuration and >> maintaining the bridged configuration also. > >Ok... > >> I have configured ebtables to redirect only http packets coming from >> eth1 to eth0 >> >> ebtables -t nat -A PREROUTING -i vif1.0 -p ipv4 --ip-protocol 6 >> --ip-destination-port 80 -j dnat --to-destination 00:16:41:55:A5:8C > >... ok ... > >> Then I put the following iptables rule to redirect the packet to a >> squid >> >> iptables -t nat -A PREROUTING -i eth0 -s 10.230.40.85 -p tcp --dport >> 80 -j REDIRECT --to-port 3128 > >... ok ... > >> I am seeing the packet coming to eth0 interface with eth0 MAC address >> and then the packet going out from eth0 with the router1 MAC address, >> so I suppose that router2 is routing the packet. However, the >> iptables rule is not working; the packet is not being redirected to >> port 3128. > >Hum. If we change your statement to be "... so I suppose that router2 >is bridging the packet ..." I'll agree with you. > >Do you have Bridge Net Filter option turned on in the kernel? Bridged >Net Filter allows IPTables to see bridged layer 2 traffic when it >normally can not. Normally IPTables will only see traffic that is >destined to or originating from or being (layer 3) routed through the >system. As such with out Bridged Net Filter being enabled in the >kernel, IPTables would never see the traffic that you are changing the >destination MAC address on. > >Now, with out knowing example source / destination IP addresses, I can't >say for sure what will happen with the traffic when it reaches the >system that it is redirected to. So this in and of its self may still >be a problem. You have a 10.230.40.85 IP address listed in your >IPTables rule, but I'm not sure where that system is and how it may or >may not correlate to your IPTables rule. > >> Does anyone know why this is happening? Since the packet is being >> routed then it should go through the PREROUTING chain, doesn't it? > >I don't know for sure what is going on, but Bridged Net Filter is >definitely something that I would look in to. > >> Thanks in advance, > >You are welcome. > > > >Grant. . . . > >----------------------------------------------------------------------- -- >This SF.net email is sponsored by: Microsoft >Defy all challenges. Microsoft(R) Visual Studio 2005. >http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/ >_______________________________________________ >Ebtables-user mailing list >[email protected] >https://lists.sourceforge.net/lists/listinfo/ebtables-user ------------------------------------------------------------------------- This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2005. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/