Re: firewall rules for NAT

From	Pascal Hambourg <pascal@plouf.fr.eu.org>
Newsgroups	linux.debian.user
Subject	Re: firewall rules for NAT
Date	2017-06-30 23:20 +0200
Message-ID	<tYbux-2ay-1@gated-at.bofh.it> (permalink)
References	(3 earlier) <tX6ng-6jD-17@gated-at.bofh.it> <tXD9w-5gl-17@gated-at.bofh.it> <tXQgq-5oe-29@gated-at.bofh.it> <tXX8f-1pk-19@gated-at.bofh.it> <tY403-5YH-43@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

Le 30/06/2017 à 15:09, Igor Cicimov a écrit :
> On Fri, Jun 30, 2017 at 3:50 PM, Pascal Hambourg <pascal@plouf.fr.eu.org>
> wrote:
>>
>> Stateful NAT requires symmetric routing, i.e. reply packets go through the
>> router that did the NAT operations on original packets and keeps the state
>> for these NAT operations.
>>
>> With the host as gateway and without the SNAT rule, routing is asymmetric :
>> client -> router VM (DNAT) -> server VM
>> server VM -> host -> client
>>
>> Reply trafic cannot be un-DNATed and communication fails.
>
> I completely agree with that and that's what I would expect to happen.
> However, as per OP's initial email (I cite):
>
> "*It works like a charm*, but there is one problem: my mail server receives
> all the connections from the router, which has its own private IP address
> (10.7.33.100), so the mail server can't enforce SPF policies nor DNS RBL
> rules on incoming mail connections."
>
> his setup was working "like a charm" and the only problem was that the
> source IP the email server was seeing was the one from the router vm and
> not the client one, nothing about failing connections.

In his second mail, after admitting that the problem was caused by the 
SNAT rule, the OP also wrote :

"The problem is that without that rule things do not work at all 
(connections time out)."

This of course rang a bell. As we all know, NAT is most often used to 
work around routing flaws. But, as we can see again, it also brings its 
own flaws.

Thread

firewall rules for NAT Lucio Crusca <lucio@sulweb.org> - 2017-06-25 23:10 +0200
  Re: firewall rules for NAT Dan Purgert <dan@djph.net> - 2017-06-26 11:50 +0200
    Re: firewall rules for NAT Lucio Crusca <lucio@sulweb.org> - 2017-06-27 13:30 +0200
      Re: firewall rules for NAT Pascal Hambourg <pascal@plouf.fr.eu.org> - 2017-06-27 23:40 +0200
        Re: firewall rules for NAT Lucio Crusca <lucio@sulweb.org> - 2017-06-29 10:40 +0200
          Re: firewall rules for NAT Igor Cicimov <icicimov@gmail.com> - 2017-06-30 00:40 +0200
            Re: firewall rules for NAT Pascal Hambourg <pascal@plouf.fr.eu.org> - 2017-06-30 08:00 +0200
              Re: firewall rules for NAT Igor Cicimov <icicimov@gmail.com> - 2017-06-30 15:20 +0200
                Re: firewall rules for NAT Pascal Hambourg <pascal@plouf.fr.eu.org> - 2017-06-30 23:20 +0200
                Re: firewall rules for NAT Igor Cicimov <icicimov@gmail.com> - 2017-07-01 03:30 +0200
                Re: firewall rules for NAT Pascal Hambourg <pascal@plouf.fr.eu.org> - 2017-07-01 11:40 +0200
                Re: firewall rules for NAT Brad Rogers <brad@fineby.me.uk> - 2017-07-01 13:10 +0200
                Re: firewall rules for NAT Pascal Hambourg <pascal@plouf.fr.eu.org> - 2017-07-01 13:30 +0200
                Re: firewall rules for NAT Brad Rogers <brad@fineby.me.uk> - 2017-07-01 13:40 +0200
                Re: firewall rules for NAT Brad Rogers <brad@fineby.me.uk> - 2017-07-01 13:50 +0200
                Re: firewall rules for NAT Igor Cicimov <icicimov@gmail.com> - 2017-07-01 16:40 +0200
      Re: firewall rules for NAT Igor Cicimov <icicimov@gmail.com> - 2017-06-29 01:10 +0200

csiph-web