3

I have 3 Linux servers:

  • 10.0.0.0/24 - (10.0.0.10) Linux server inside my LAN.
  • 20.0.0.0/24 - (20.0.0.10) Linux server with HTTP Apache server
  • 50.50.50.50/32 - Server on Amazon AWS which see both 10.x and 20.x LANs.

10.x cannot see 20.x and 20.x cannot see 10.x
What is the best way (and how can I do it) to se 50.50.50.50 server on AWS to create tunnel from 10.x to 20.x

20.0.0.10 runs HTTPd server on "DMZ" LAN. I need to see 20.0.0.10:80 from my 10.0.0.0/24 servers.
The 2 networks 10.x and 20.x is on the same Cisco ASA firewall/router, but I cannot route because of License issues, so i want to bypass this by external server which can see 20.x network. I want to be able to go to 50.50.50.50:80 from 10.x servers and see 20.0.0.10:80 content.

  • It seems to me that there are already two tunnels so that none needs to be created any more. In that case you just have to (a) configure routing in both networks (making the tunnel address of 50.50.50.50 the gateway for the other network) and (b) allow forwarding between the two tunnel interfaces on 50.50.50.50. – Hauke Laging May 5 '14 at 8:03
  • So instead of Tunnel I need to make 50.50.50.50 as a router? – gabi May 5 '14 at 8:18
  • If that's what you want. You could also create a direct tunnel between the networks but that would be completely independent of 50.50.50.50. – Hauke Laging May 5 '14 at 8:23
  • Actually I dont want to be able to route back from 20.x to 10.x (10.x is my private internal LAN and 20.x is my "DMZ" ) so it looks like tunnel is my best option here, no? – gabi May 5 '14 at 8:24
  • Is 20.0.0.0/24 actually available for local use? I thought only 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 were available for local use. – celtschk May 5 '14 at 8:46
0

You describe quite different cases in your question. If you want to reach only 20.x:80 via 50.50.50.50:80 then you can configure port forwarding on 50.50.50.50 with iptables:

target_ip="20.1.2.3"
source_ip="50.50.50.50"
iptables -t nat -A PREROUTING -s 10.0.0.0/8 -p tcp --dport 80 -j DNAT --to-destination 20.1.2.3
iptables -t nat -A POSTROUTING -s 10.0.0.0/8 -d "$target_ip" -p tcp --dport 80 -j SNAT --to-source "$source_ip"
iptables -A FORWARD -s 10.0.0.0/8 -d "$target_ip" -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -d 10.0.0.0/8 -s "$target_ip" -p tcp --sport 80 -j ACCEPT
echo 1 >/proc/sys/net/ipv4/ip_forward

If there is a tunnel between 20.0.0.0/8 and 50.50.50.50 then you probably have to set $source_ip to the tunnel interface IP address.

  • I probably misunderstood the terms. Tunnel is the ability to access specific machine you cannot access directly, with another server which can access to the machine, no? so it is my case here - I need to access 20.0.0.10 (assume it is real external valid IP) from 10.0.0.10 (Private LAN - non legal IP). 10.x cannot see 20.x , but EC2 machine can see it.. – gabi May 5 '14 at 8:48
  • "Tunnel" is a general term. My understanding of it is: You create a transparent connection between hosts or networks in both directions. Thus I would not call port forwarding a tunnel. And you would call the connecting system a router rather than a server. – Hauke Laging May 5 '14 at 8:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.