Re: apparent routing problem

If you are running redhat, then it 'should' have an rc file. It will check to
see if /etc/sysconfig/iptables exists and apply the mod if necessary.

Below is one of my iptables configs. 

Generally I find it easier (mostly out of habit) to create my rules then do an
iptables-save to make the configuration, but you can just edit the file too.
In the config, which is quite open (it's from a trusted test box), there is
one line which is just a route through the machine to map to ssh on one of the
real servers, that's port 1001. The line after that is the one that allows
traffic to pass back through the firewall to the public. 

Hope that helps!

P


# Generated by iptables-save v1.2.6a on Thu Feb 13 11:41:32 2003
*nat
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A PREROUTING -p tcp -m tcp -i eth0 --dport 1001 -j DNAT --to destination
192.168.1.10:22
-A POSTROUTING -o eth3 -j MASQUERADE
COMMIT
# Completed on Thu Feb 13 11:41:32 2003
# Generated by iptables-save v1.2.6a on Thu Feb 13 11:41:32 2003
*mangle
:PREROUTING ACCEPT [4416:495339]
:INPUT ACCEPT [18035:1799164]
:FORWARD ACCEPT [189:20535]
:OUTPUT ACCEPT [3254:1159347]
:POSTROUTING ACCEPT [7812:2205804]
COMMIT
# Completed on Thu Feb 13 11:41:32 2003
# Generated by iptables-save v1.2.6a on Thu Feb 13 11:41:32 2003
*filter
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
COMMIT
# Completed on Thu Feb 13 11:41:32 2003


"Stephen Spalding" <[email protected]> wrote:

> Will there be any kind of PREROUTING statement to go along with it?
> Also, I've been using 'modprobe iptables' after reboot to load the
> iptables kernel modules. Is this something that I should go ahead and
> put into /etc/rc.d/rc.local? Are there any other commands that I need to
> be aware of? The install doc that I got with piranha isn't real clear on
> iptables.
> 
> >>> [email protected] 04/29/03 08:50AM >>>
> Nope.. It will assume the route of the root interface. A rule of thumb,
> NEVER
> edit interfaces controlled by piranha.. Saves lots of headaches!
> 
> P
> 
> "Stephen Spalding" <[email protected]> wrote:
> 
> > Should the line read:
> > 
> > -A POSTROUTING -o eth0:1 -j MASQUERADE
> > or 
> > -A POSTROUTING -o 10.0.3.132 -j MASQUERADE
> > 
> > to signify the VIP address?
> > 
> > >>> [email protected] 04/29/03 08:32AM >>>
> > Right... Is it returning a page to the browser at all, or are you
> > looking in
> > the logs or tcpdump to find out what it hits?
> > 
> > This will MASQUERADE outgoing packets with the virtual IP:
> > 
> > -A POSTROUTING -o eth0 -j MASQUERADE
> > 
> > If this line is not there, the machine will not let packets go back
> to
> > the
> > client. To my knowledge, IPVS is NOT stateful, so it will not route
> > outgoing
> > packets on it own. The firewall must do this.
> > 
> > Let me know-
> > 
> > P
> > 
> > 
> > 
> > 
> > "Stephen Spalding" <[email protected]> wrote:
> > 
> > > I've already got the default route of the real servers set to
> > > 10.0.1.254.
> > > 
> > > Again, the problem is that I can only see the real servers from
> one
> > > server on my internal network which just happens to have an
> internet
> > > interface. I'm pretty sure that it is going through the load
> balancer
> > to
> > > get there as every time I hit refresh on the browser it chooses a
> > > different real server. 
> > > 
> > > >>> [email protected] 04/28/03 08:05AM >>>
> > > > I figured it was something like that. What would the syntax of
> my
> > > > iptables command be if on my lvs router if it was configured
> like
> > > this:
> > > > 
> > > > virtual server: 10.0.3.132
> > > > eth0: 10.0.3.133
> > > > eth1: 10.0.1.6
> > > > nat router: 10.0.1.254
> > > 
> > > There's no iptables need, ipvs *is* masquerading your traffic. You
> > > just
> > > need to set the default route thru the director on the realservers
> :
> > > 
> > > route add default gw 10.0.1.254
> > > 
> > > The permanent way to do that is to edit /etc/sysconfig/network and
> > set
> > > GATEWAY=10.0.1.254
> > 
> > 
> > _________________________________________________________
> > This mail sent using V-webmail - http://www.v-webmail.org 
> > 
> > 
> > 
> > _______________________________________________
> > Piranha-list mailing list
> > [email protected] 
> > https://listman.redhat.com/mailman/listinfo/piranha-list 
> > 
> > 
> > 
> > 
> > _______________________________________________
> > Piranha-list mailing list
> > [email protected] 
> > https://listman.redhat.com/mailman/listinfo/piranha-list 
> > 
> 
> _________________________________________________________
> This mail sent using V-webmail - http://www.v-webmail.org 
> 
> 
> 
> _______________________________________________
> Piranha-list mailing list
> [email protected] 
> https://listman.redhat.com/mailman/listinfo/piranha-list 
> 
> 
> 
> 
> _______________________________________________
> Piranha-list mailing list
> [email protected]
> https://listman.redhat.com/mailman/listinfo/piranha-list
> 

_________________________________________________________
This mail sent using V-webmail - http://www.v-webmail.org