3

I have this situation: a piece of software got hardcoded IP address (let assume it is being 196.10.10.100:20000) to which it binds a socket and sends TCP and UDP traffic to 196.10.10.9:20000 (hardcoded too). Problem is that for system to work there should be several instances of this software on separate different hosts. There is no chance to modify the software.

original setup was involving some kind of non-RFC compatible network hardware that was mapping MACs in first LAN into MACs in second LAN. Now it is required to emulate it without any extra network hardware - just a hot per instance of client and a host for server. There is (new) server software that expect to accept packets and respond, using separate NIC for each instance, IP addresses allowed to be in arbitrary subnets.

I do not see any problem with the server part, but there is now way that hosts with same IPs can be connected to server. I assume there is no problem with using system software to resolve it, but I don't know how to emulate an interface with required IP on client host and redirect traffic to server, to send traffic from server to client software (which would expect it coming from non-existing 196.10.10.9). I was told that it is possible with iptables, but all I know about that iptables is packet filter\NAT software. I may doubt that suggestion, because one who told me so knows even less than me. I have partial solution, without DMZ and redirection of traffic to proper ip

ip netns add vn
ip link add v-eth0 type veth peer name v-local
ip link set v-local netns vn

ip addr add 196.10.10.1/24 dev v-eth0
ip netns exec vn ip addr add 196.10.10.100/24 dev v-local
ip link set v-eth0 up
ip netns exec vn ip link set v-local up

ip netns exec vn ip route add default via 196.10.10.1
echo 1 > /sys/net/ipv4/ip_forward
iptables -P FORWARD DROP
iptables -F FORWARD
iptables -t nat -F
iptables -t nat -A POSTROUTING -s 196.10.10.0/255.255.255.0 -o eth0 -j MASQUERADE
iptables -A FORWARD -i eth0 -o v-eth0 -j ACCEPT
iptables -A FORWARD -o eth0 -i v-eth0 -j ACCEPT

This setup allows process in namespace container to access real network, but doesn't allow redirectio I require. Let assume that eth0 got IP 196.10.20.100 and server got IP 196.10.20.9. How I should modify the script above to be able

1) to redirect packets from 196.10.10.100 destinated to 196.10.10.9, so they would be sent to 196.10.20.9, and

2) to redirect packets, received by 196.10.20.100, to be sent to 10.10.10.100?

  • Have you confirmed this IP can not be hex-edited? – Tigger May 12 '17 at 8:57
  • @Tigger 3 problems with that: 1) checksum wouldn't match, software checks it's consistency 2) this would an official document that would describe practice of..what, IP breach? 3) hex edit would require create copy of software for each client host, their number and network configuration is changeable – Swift May 12 '17 at 9:08
  • @dr01 I can't name software or producer, but producer is formerly department of same co, suspected of inside trade in cooperation with subcontractor that developed MAC substitution device – Swift May 12 '17 at 9:11
  • 1
    Look at the snat and dnat targets for iptables (see man iptables-extensions). You may need an additional instance or network namespace with veth pairs to do the actual masquerading. I haven't done this myself yet, so I can't give step-by-step instructions. – dirkt May 12 '17 at 11:34
  • @dirkt iptables-extensions do not exist on this platform. Is it screwed then? (and no, not in repository, they don't exist at all), Namepaces are supported, and that far I know that it requres to create namespace and virtual interfaces – Swift May 14 '17 at 9:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.