Re: NAT/IPTables question with pptpd

Something seems fishy here.  Why are you SNATing based on a destination address?  The typical use case for SNAT (or MASQUERADE, which is really a specialized form of SNAT) is to make the outside world "think" all your traffic is coming from your public gateway, instead of computers behind your public gateway.  Or, say, you're hosting an email server or something else that initiates new outbound connections.  you want to make sure outbound SMTP traffic started by your email server has a public "from" IP Address, so then you would set up a SNAT rule.  

In your case, the logic I think you want to implement is on handling inbound traffic and sending it out the correct interface based on the sender.  So you would use a DNAT rule in PREROUTING, versus an SNAT rule in POSTROUTING.  

- Greg Scott


-----Original Message-----
From: Chris Boyd [mailto:[email protected]] 
Sent: Thursday, April 25, 2013 11:54 AM
To: [email protected]
Subject: [Poptop-server] NAT/IPTables question with pptpd

Hello,


I've successfully installed pptpd on an Ubuntu 12.10 server, and configured it to do what I need -- temporary convenient access to a remote network by NAT'ing the PPTP IP addresses to the internal LAN.  I'd also like to be able to access the global Internet via NAT to the PPTP server's public IP address.

Here's the config:

eth0 - Public IP address

eth1 - Private IP address 10.10.10.208/24

pptpd.conf is using 172.29.249.0/24

I can successfully NAT to either the server's public address on eth0 with iptables -t nat -A POSTROUTING -s 172.29.249.0/24 -o eth0 -j MASQUERADE

Or the eth1 address with
iptables -t nat -A POSTROUTING -s 172.29.249.0/24 -o eth1 -j MASQUERADE

I just can't seem to find the iptables config that implements this sort of logic:

	If the destination address is 10.10.10.0/24
		then
			NAT to eth1 IP address
		else
			NAT to eth0 IP address

I'm continuing to comb through the iptables man page in the mean time.

Another alternative might be to send the client a route to 10.10.10.0/24, but the config files don't seem to hint at that being possible.

Thanks for the hints,

--Chris



------------------------------------------------------------------------------
Try New Relic Now & We'll Send You this Cool Shirt New Relic is the only SaaS-based application performance monitoring service that delivers powerful full stack analytics. Optimize and monitor your browser, app, & servers with just a few lines of code. Try New Relic and get this awesome Nerd Life shirt! http://p.sf.net/sfu/newrelic_d2d_apr
_______________________________________________
Poptop-server mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/poptop-server

------------------------------------------------------------------------------
Try New Relic Now & We'll Send You this Cool Shirt
New Relic is the only SaaS-based application performance monitoring service 
that delivers powerful full stack analytics. Optimize and monitor your
browser, app, & servers with just a few lines of code. Try New Relic
and get this awesome Nerd Life shirt! http://p.sf.net/sfu/newrelic_d2d_apr