3

Homework assignment...

There are 3 computers in a local network: 192.168.0.185 (the 'client'), 192.168.0.129 (the 'gateway') and 192.168.0.81 (the 'server'). The 'server' is running a HTTP server, so typing 192.168.0.81 in a browser's address bar from any of the other two computers displays a webpage.

The assignment is to set up NAT in the so-called 'gateway' in such a way that typing its IP address (192.168.0.129) in the 'client's browser will display the webpage served by the 'server'. This is my solution attempt:

echo 1 > /proc/sys/net/ipv4/ip_forward

iptables -t nat -A PREROUTING -p tcp -d 192.168.0.129 --dport 80 -j DNAT --to 192.168.0.81:80
iptables -t nat -A POSTROUTING -p tcp -d 192.168.0.81 --dport 80 -j SNAT --to 192.168.0.129:80

This (I hoped) would make the 'gateway' redirect requests made to it to the 'server' (DNAT) while substituting source address of the request to its own so that the 'server' will correctly send the response through the 'gateway' and not straightly to the 'client' (SNAT).

I typed the 'gateway's IP in the 'client's browser's address bar. Hooray! I saw the webpage! I thought I was done!

Except I wasn't. I then reloaded the page on the 'client'. And I got timeout error. I reloaded the page once again. Timeout again. I waited a teeny tiny bit and reloaded once again. This page the webpage was served correctly. So I reloaded for the final time and... timeout.

This confuses me. It seems that once a page is served things stop working for a while. Why is that happening? Where is my mistake?

I should note that typing the 'server's address in the 'client's browser (as opposed to typing the 'gateway's address) does not cause such problems.

5
  • could be a problem with the web server
    – jsotola
    Jan 16, 2019 at 4:03
  • @jsotola I don't think so; please see the edited question.
    – gaazkam
    Jan 16, 2019 at 4:07
  • @jsotola Because the assignment says I have to configure the 'gateway' in such a way to make this possible.
    – gaazkam
    Jan 16, 2019 at 4:11
  • The way to debug this is to use tcpdump or wireshark on all network interfaces that may be interesting, and look at which packets go where, and what is happening to them. (1) If all 3 computers are connected to a single switch, watch out for ICMP REDIRECT messages which will take the gateway out of the loop. (2) You don't have to use both SNAT and DNAT; the connection tracker will take care of SNAT.
    – dirkt
    Jan 16, 2019 at 7:46
  • @dirkt Wrt SNAT: I was trying to remove this and things stopped working completely. I think the server was trying to send its responses omitting the 'gateway' then.
    – gaazkam
    Jan 16, 2019 at 8:21

2 Answers 2

1

I think I got it finally. The culprit was this line:

iptables -t nat -A POSTROUTING -p tcp -d 192.168.0.81 --dport 80 -j SNAT --to 192.168.0.129:80

Things started working when I changed it to this:

iptables -t nat -A POSTROUTING -p tcp -d 192.168.0.81 --dport 80 -j SNAT --to 192.168.0.129

Not sure why but I have a vague idea that NAT uses ports to identify connections. So specifying only one port was leading into conflicts when there was more than 1 request.

1
  • You nailed it: NAT HOWTO - Mappings In Depth see "Implicit Source Port Mapping" and "What Happens When NAT Fails". You can use the conntrack command (with options -L or -E) to see what's going on
    – A.B
    Jan 17, 2019 at 1:42
0

I have a PC with Debian, serving as router and may share some experience with you.

Routing

If you are intentionally using host as a router, dont ever do

echo 1 > /proc/sys/net/ipv4/ip_forward

Instead do either:

  • sysctl -w net.ipv4.ip_forward=1
  • nano /etc/sysctl.conf:
    • and edit net.ipv4.ip_forward = 1

Forwarding

Oh I've just noticed that you can offer following stuff all almost without magic. That's just the production answer - its up to you now to dig inside configurations (google shorewall sources - then you will know how iptables parsers/generators work)

Next I can advise some webmin web interface to play with it - you access 192.168.0.81:10000 Now you have no reason to learn command line - all iptables stuff is now done through web interface! ;) Also read its shell scripts and know now, how production things are working!

Logging

webmin did all stuff, but if you are on debian and want a console log - just type apt install iftop (google iftop sources, read, educate)


Feel free to like and accept this post, if you found my time and this info useful!

10
  • Why should I never do echo 1 > /proc/sys/net/ipv4/ip_forward?
    – gaazkam
    Jan 16, 2019 at 6:09
  • @gaazkam because it has a standart way of defining default-behaviour of defining that at a boot time, having that setting ready "on" and not waiting your custom script or shell to interacting, to run specific router-init stuff at system init!!! Read the answer, stop inventing things alredy invented at century ago))
    – xakepp35
    Jan 16, 2019 at 6:19
  • I'm sorry but I don't think I'm allowed to use tools like Shorewall or Webmin, just vanilla iptables I'm afraid ;/ Also - Im terribly sorry, but I feel reading source code of these tools is... kind of overkillish if my goal is just to set up NAT for a single time
    – gaazkam
    Jan 16, 2019 at 6:20
  • those are mutually exclusive things. If you want to learn topic - you have to look at "what to be done as per today" - what binaries and utilities are availble - that's at least. Good if you could examinate their source code, surface level at least
    – xakepp35
    Jan 16, 2019 at 6:23
  • If you dont want to learn topic - pay a bribe to an educator and never appear here anymore)))
    – xakepp35
    Jan 16, 2019 at 6:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .