[CentOS] IPv4 192.168.71.1 'leaks out onto WAN.

[Peter Brady]

On 8/06/13 5:03 AM, James B. Byrne wrote:

<snip>

> Presently we masquerade 192.168.0.0/16 in a NAT POSTROUTING chain
> which handles the internal hosts seeking addresses on the WAN. 
> However, I am unsure of how to handle the gateway itself.  Is this
> situation best handled by a permanent route reflecting 192.168 to eth1
> only?  Or, is it handled better by an addition to the OUTPUT chain in
> the NAT IPTable?  Or, is the best method something else entirely of
> which I am unaware?

If I recall correctly you would have to have the appropriate routes set
up, namely:

-Default to the WAN interface, which I assume is dynamic because you are
masquerading.
-static to the network/s on and behind eth1
-static to the network/s on and behind eth1:192071
-static routes back to the gateway from any routers behind the internal
networks.

then wouldn't the gateway just handle itself.  Masquerading is source
NAT to a dynamic interface therefore all packet mangling is done after
the routing.  Hence, a packet that originates from within the gateway
heading out would bypass the routing chain would use the static routes
to try to exit via the WAN interface and then get caught via the
POSTROUTING rule and be handled by that chain.  Then if it exited
through the WAN interface:

-the world sees it as originating from that interface
-there is a NAT translation left in place so packets coming back would
be mangled back to the correct source.

Alternatively, if the packet originates from the gateway to head
internally it would, again, bypass the routing chain and use the static
routes to decide which interface to exit on.  There would be no NAT
translation left in place because the rules would only apply for
incoming packets looking to exit via the WAN and only remain in place
for the translations they have set up.  Also there would be no need for
NAT as all the internal addresses are routeable as far as a packet that
originates from the gateway is concerned.

An +1 for adding MAC addresses.  I've come across a couple of switches
that prefer multiple MAC addresses for cloned, aliased and tagged
interfaces.  Test and see what you need.

Cheers
-pete

-- 
Peter Brady
Email: pdbrady at ans.com.au
Skype: pbrady77

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 946 bytes
Desc: OpenPGP digital signature
URL: <http://lists.centos.org/pipermail/centos/attachments/20130608/2bf01894/attachment.sig>