Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #2882

Re: Accessing devices behind a router

Show all headers | View raw

On 30/03/14 14:09, Pascal Hambourg wrote:
> Hello,
> 
> David Brown a écrit :
>> On 30/03/14 09:30, Richard Kettlewell wrote:
>>>
>>> The answer is that you need an additional rewrite rule in M which
>>> rewrites the source address to M (and only applies to packets received
>>> from your local network).  If M happens to be a Linux box then the
>>> iptables SNAT target can do it.
>>
>> An alternative way to handle this situation is using DNS and different 
>> name-host resolution in different situations.
> 
> Note that this option does not work if the same name is used for several
> services/ports (ex : HTTP and FTP) which are forwarded to different hosts.

That's indeed true - but there's a good chance that the OP doesn't have
more than one server here.  If there are several hosts involved then you
need multiple names for them.

> 
>> An alternative possibility is to use iptable rules on P to check the 
>> incoming packets checking for T->P packets that come from the MAC 
>> address of M, and apply SNAT at that point so that the web server sees 
>> the packet as M->P and sends the return to T back via M.
> 
> This cannot be performed with the usual stateful NAT available with
> iptables (SNAT), and requires stateless NAT (RAWSNAT).

I haven't looked at the details of how this would be done, but that
sounds right.

> 
>> Another possibility is simply to put an explicit route in P that directs 
>> all packets to T via M.
> 
> When the outgoing packet belongs to a connection which was forwarded
> from the LAN by the router. Yes, I like it. Requires just a bit of
> iptables and routing rules.
> 

Other ideas you could use here are to put an alias on the server's
ethernet port and use that for incoming packets forwarded through M - it
will make it easier to tell where packets are coming from.

There are endless tricks that can be played using Linux networking.  All
you need are a second computer that has access to google while you break
the networking on your main machine, plenty of notepaper, wireshark, and
hair to pull out when things don't work!

Back to comp.os.linux.networking | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Accessing devices behind a router Clark Smith <noaddress@nowhere.net> - 2014-03-30 01:30 +0000
  Re: Accessing devices behind a router Richard Kettlewell <rjk@greenend.org.uk> - 2014-03-30 08:30 +0100
    Re: Accessing devices behind a router David Brown <david.brown@hesbynett.no> - 2014-03-30 13:33 +0200
      Re: Accessing devices behind a router Pascal Hambourg <boite-a-spam@plouf.fr.eu.org> - 2014-03-30 14:09 +0200
        Re: Accessing devices behind a router David Brown <david.brown@hesbynett.no> - 2014-03-31 09:22 +0200
  Re: Accessing devices behind a router Clark Smith <noaddress@nowhere.net> - 2014-04-03 22:13 +0000
    Re: Accessing devices behind a router David Brown <david.brown@hesbynett.no> - 2014-04-04 09:01 +0200
      Re: Accessing devices behind a router Jorgen Grahn <grahn+nntp@snipabacken.se> - 2014-04-04 16:33 +0000
        Re: Accessing devices behind a router David Brown <david.brown@hesbynett.no> - 2014-04-06 14:26 +0200
      Re: Accessing devices behind a router Clark Smith <noaddress@nowhere.net> - 2014-04-04 19:20 +0000
        DNS caching servers [Was: Accessing devices behind a router] Ian Zimmerman <itz@buug.org> - 2014-04-08 10:32 -0700

csiph-web