| View previous topic :: View next topic |
| Author |
Message |
Lucho[FLCL]
Apprentice
Joined: 02 Dec 2003
Posts: 245
Location: Buenos Aires - Argentina
|
 Posted: Wed Feb 11, 2004 4:02 pm Post subject: Masquerading question |
 |
|
I'm using a firewall between two networks (it's just a Gentoo Linux w/iptables...) (192.168.11.0 and 192.168.0.0). I'm using masquerading because the 192.168.11.0 net has another 192.168.0.0 net linked to it and it cannot be changed because it is a client's LAN (accessed through VPN). Everything works fine.
The problem is that the machine I'm connecting to accepts only 1 incoming connection per IP address. With masquerading, all the connections go out with the same IP address...so...
The question is, is there any way to use a range of addresses instead of just one? (I don't think so, but I wanted to ask anyway....)
Thank you very much for your help |
|
| Back to top |
|
 |
MrPyro
Tux's lil' helper
Joined: 14 Aug 2003
Posts: 121
Location: Sheffield, England
|
| Posted: Wed Feb 11, 2004 4:23 pm Post subject: |
|
|
I think there is a way using NAT to re-write an IP address from one network to another IP address on a different network.
Try something like
| Code: |
$IPT -t nat -A POSTROUTING -s 192.168.0.13 -i $IN_DEV-o $OUT_DEV -j SNAT --to-source 192.168.11.13 |
This should (although I make no guarantees about this) map requests on $IN_DEV from 192.168.0.13 to the outside world look like they come from 192.168.11.13. You will have to set up $OUT_DEV (the device connected to the 192.168.11.* network) to use multiple ip address aliases. You will also need one iptables line per ip address to be remapped.
Check the iptables man page, especially for stuff on SNAT.
_________________
Back off man, I'm a computer scientist |
|
| Back to top |
|
|
Lucho[FLCL]
Apprentice
Joined: 02 Dec 2003
Posts: 245
Location: Buenos Aires - Argentina
|
| Posted: Wed Feb 11, 2004 4:29 pm Post subject: |
|
|
Thank you, it may be interesting to try that....
Anyway, is there something like that but automagical?
At least a way to pipe that thing with a script/program...that way I could make the conversion based on source IP address....but that sounds like fantasy... |
|
| Back to top |
|
|
|
Networking & Security
