How to redirect packets to multiple machines

padukes · Apprentice Joined: 27 Feb 2003 Posts: 232

Hi All,

I have a gentoo box acting as my NAT/firewall via iptables. Behind the firewall I have two machines which want to run the same app (WinMX). Unfortunately, this app requires accepting connections on a particular port (6699). Is there anyway to setup the NAT/Firewall such that incoming connections can be forwarded to both machines?

Thanks,
P

JPMRaptor · Guru Joined: 04 Oct 2002 Posts: 410 Location: Maryland

I don't think so. There are a few exceptions where this can work (FTP ...) but the incoming conneciton has to be in response to some request. Even then the support for this is down in the firewall code somewhere. I know I had to put some stuff in the ipchains config on my router/firewall to support FTP and a few other special cases.

Chris W · Posted: Sat Jan 03, 2004 3:48 am Post subject:

In general, what you request is not possible if the server port number is fixed. In a NAT environment both machines appear to be at the same address. An incoming request to port 6699 will arrive at the NAT machine's external interface with nothing that would allow redirection to one or the other of the internal machines. In some limited cases a NAT helper module can be written that may allow something like this to work by looking at what related connections/traffic has gone before. Such a helper is strongly tied to the prototcol in use.

I get the impression that WinMX can operate in two modes: Server and Firewall. Run in firewall mode and you have no need to accept incoming requests.

Alternatively, if the server address is configurable then set one to 6699 and the other to 6670 and redirect accordingly.
_________________
Cheers,
Chris W
"Common sense: The collection of prejudices acquired by age 18." -- Einstein

funkmankey · Guru Joined: 06 Mar 2003 Posts: 304 Location: CH

ralph wiggum's disembodied head is quite right.

it's probably more hassle than it will be worth, but a STUN server may be able make NAT do what you want.

hm, too bad there is not a way to make iptables filter on FQDN (or is there?) -- some prerouting trickery a la virtual hostnames might work...
_________________
I've got the brain, I'm insane, you can't stop the power