mjhjmtu

Homework assignment...

There are 3 computers in a local network: 192.168.0.185 (the 'client'), 192.168.0.129 (the 'gateway') and 192.168.0.81 (the 'server'). The 'server' is running a HTTP server, so typing 192.168.0.81 in a browser's address bar from any of the other two computers displays a webpage.

The assignment is to set up NAT in the so-called 'gateway' in such a way that typing its IP address (192.168.0.129) in the 'client's browser will display the webpage served by the 'server'. This is my solution attempt:

echo 1 > /proc/sys/net/ipv4/ip_forward

iptables -t nat -A PREROUTING -p tcp -d 192.168.0.129 --dport 80 -j DNAT --to 192.168.0.81:80
iptables -t nat -A POSTROUTING -p tcp -d 192.168.0.81 --dport 80 -j SNAT --to 192.168.0.129:80

This (I hoped) would make the 'gateway' redirect requests made to it to the 'server' (DNAT) while substituting source address of the request to its own so that the 'server' will correctly send the response through the 'gateway' and not straightly to the 'client' (SNAT).

I typed the 'gateway's IP in the 'client's browser's address bar. Hooray! I saw the webpage! I thought I was done!

Except I wasn't. I then reloaded the page on the 'client'. And I got timeout error. I reloaded the page once again. Timeout again. I waited a teeny tiny bit and reloaded once again. This page the webpage was served correctly. So I reloaded for the final time and... timeout.

This confuses me. It seems that once a page is served things stop working for a while. Why is that happening? Where is my mistake?

I should note that typing the 'server's address in the 'client's browser (as opposed to typing the 'gateway's address) does not cause such problems.

I think I got it finally. The culprit was this line:

iptables -t nat -A POSTROUTING -p tcp -d 192.168.0.81 --dport 80 -j SNAT --to 192.168.0.129:80

Things started working when I changed it to this:

iptables -t nat -A POSTROUTING -p tcp -d 192.168.0.81 --dport 80 -j SNAT --to 192.168.0.129

Not sure why but I have a vague idea that NAT uses ports to identify connections. So specifying only one port was leading into conflicts when there was more than 1 request.

I have a PC with Debian, serving as router and may share some experience with you.

Routing

If you are intentionally using host as a router, dont ever do

echo 1 > /proc/sys/net/ipv4/ip_forward

Instead do either:

• sysctl -w net.ipv4.ip_forward=1


• 
  nano /etc/sysctl.conf:
  
  
  • and edit net.ipv4.ip_forward = 1
    
  
  

Forwarding

Oh I've just noticed that you can offer following stuff all almost without magic. That's just the production answer - its up to you now to dig inside configurations (google shorewall sources - then you will know how iptables parsers/generators work)

Next I can advise some webmin web interface to play with it - you access 192.168.0.81:10000 Now you have no reason to learn command line - all iptables stuff is now done through web interface! ;) Also read its shell scripts and know now, how production things are working!

Logging

webmin did all stuff, but if you are on debian and want a console log - just type apt install iftop (google iftop sources, read, educate)

Feel free to like and accept this post, if you found my time and this info useful!