RE: Routing Multiple Inbound IP Addresses -- How?

RE: Routing Multiple Inbound IP Addresses -- How?

[Dawes, Stephen]

Not necessary, and don't know the effects if you do.
 


Steve Dawes
Phone: (403) 268-5527
Email: SDawes@calgary.ca
 
 

NOTICE -
This communication is intended ONLY for the use of the person or entity named above and may contain information that is confidential or legally privileged. If you are not the intended recipient named above or a person responsible for delivering messages or communications to the intended recipient, YOU ARE HEREBY NOTIFIED that any use, distribution, or copying of this communication or any of the information contained in it is strictly prohibited. If you have received this communication in error, please notify us immediately by telephone and then destroy or delete this communication, or return it to us by mail if requested by us. The City of Calgary thanks you for your attention and cooperation.

-----Original Message-----
From: speakup-bounces@braille.uwo.ca
[mailto:speakup-bounces@braille.uwo.ca] On Behalf Of Janina Sajka
Sent: 2005 November 29 6:37 PM
To: Speakup is a screen review system for Linux.
Subject: Re: Routing Multiple Inbound IP Addresses -- How?

Do I also need to accept explicitly, some version of:

iptables -t filter -A FORWARD -j ACCEPT


Or is that superfluous?

Re: Routing Multiple Inbound IP Addresses -- How?

[Ralph W. Reid]

The discussions here seem to cover the iptables commands pretty well
(based on my limited experience with this kind of thing).  However,
once the addresses are translated, how are you routing the packets to
your LAN?  If the translated addresses are not routed anywhere
(perhaps via `route'), then there seems to be no way to make a
connection to the systems.  I am largely guessing at this point (no
flames please), but if no routing has been established for the
internal addresses, then perhaps no connections are actually being
established.  Run `route' from a command line on the machine connected
to your MODEM with no parameters to see if there are any routes to
your LAN addresses.  If not, then route can be used to establish some
as follows:

route add -host 192.168.0.1 eth1
route add -host 192.168.0.2 eth2
route add -net 10.0.0.0/8 eth2

HTH, and have a _great_ day.

On Wed, Nov 30, 2005 at 08:39:37AM -0700, Dawes, Stephen wrote:
> Not necessary, and don't know the effects if you do.
>  
> 
> 
> Steve Dawes
> Phone: (403) 268-5527
> Email: SDawes@calgary.ca
>  
>  
> 
> NOTICE -
> This communication is intended ONLY for the use of the person or entity named above and may contain information that is confidential or legally privileged. If you are not the intended recipient named above or a person responsible for delivering messages or communications to the intended recipient, YOU ARE HEREBY NOTIFIED that any use, distribution, or copying of this communication or any of the information contained in it is strictly prohibited. If you have received this communication in error, please notify us immediately by telephone and then destroy or delete this communication, or return it to us by mail if requested by us. The City of Calgary thanks you for your attention and cooperation.
> 
> -----Original Message-----
> From: speakup-bounces@braille.uwo.ca
> [mailto:speakup-bounces@braille.uwo.ca] On Behalf Of Janina Sajka
> Sent: 2005 November 29 6:37 PM
> To: Speakup is a screen review system for Linux.
> Subject: Re: Routing Multiple Inbound IP Addresses -- How?
> 
> Do I also need to accept explicitly, some version of:
> 
> iptables -t filter -A FORWARD -j ACCEPT
> 
> 
> Or is that superfluous?
> 
> 
> _______________________________________________
> Speakup mailing list
> Speakup@braille.uwo.ca
> http://speech.braille.uwo.ca/mailman/listinfo/speakup

-- 
Ralph.  N6BNO.  Wisdom comes from central processing, not from I/O.
rreid@sunset.net  http://personalweb.sunset.net/~rreid
...passing through The City of Internet at the speed of light!
SEC (x) / COSEC (x) = (TAN (x) / COTAN (x)) ^ 2

Re: Routing Multiple Inbound IP Addresses -- How?

[Janina Sajka]

appreciate the thought, but routing is OK.

PS: The device where I'm trying to do all this is a Linksys WRT54gs
running OpenWRT. So, I've got all the great Linux tools natively on the
box -- except Speakup and the kitchen sink.

Ralph W. Reid writes:
> The discussions here seem to cover the iptables commands pretty well
> (based on my limited experience with this kind of thing).  However,
> once the addresses are translated, how are you routing the packets to
> your LAN?  If the translated addresses are not routed anywhere
> (perhaps via `route'), then there seems to be no way to make a
> connection to the systems.  I am largely guessing at this point (no
> flames please), but if no routing has been established for the
> internal addresses, then perhaps no connections are actually being
> established.  Run `route' from a command line on the machine connected
> to your MODEM with no parameters to see if there are any routes to
> your LAN addresses.  If not, then route can be used to establish some
> as follows:
> 
> route add -host 192.168.0.1 eth1
> route add -host 192.168.0.2 eth2
> route add -net 10.0.0.0/8 eth2
> 
> HTH, and have a _great_ day.
> 
> On Wed, Nov 30, 2005 at 08:39:37AM -0700, Dawes, Stephen wrote:
> > Not necessary, and don't know the effects if you do.
> >  
> > 
> > 
> > Steve Dawes
> > Phone: (403) 268-5527
> > Email: SDawes@calgary.ca
> >  
> >  
> > 
> > NOTICE -
> > This communication is intended ONLY for the use of the person or entity named above and may contain information that is confidential or legally privileged. If you are not the intended recipient named above or a person responsible for delivering messages or communications to the intended recipient, YOU ARE HEREBY NOTIFIED that any use, distribution, or copying of this communication or any of the information contained in it is strictly prohibited. If you have received this communication in error, please notify us immediately by telephone and then destroy or delete this communication, or return it to us by mail if requested by us. The City of Calgary thanks you for your attention and cooperation.
> > 
> > -----Original Message-----
> > From: speakup-bounces@braille.uwo.ca
> > [mailto:speakup-bounces@braille.uwo.ca] On Behalf Of Janina Sajka
> > Sent: 2005 November 29 6:37 PM
> > To: Speakup is a screen review system for Linux.
> > Subject: Re: Routing Multiple Inbound IP Addresses -- How?
> > 
> > Do I also need to accept explicitly, some version of:
> > 
> > iptables -t filter -A FORWARD -j ACCEPT
> > 
> > 
> > Or is that superfluous?
> > 
> > 
> > _______________________________________________
> > Speakup mailing list
> > Speakup@braille.uwo.ca
> > http://speech.braille.uwo.ca/mailman/listinfo/speakup
> 
> -- 
> Ralph.  N6BNO.  Wisdom comes from central processing, not from I/O.
> rreid@sunset.net  http://personalweb.sunset.net/~rreid
> ...passing through The City of Internet at the speed of light!
> SEC (x) / COSEC (x) = (TAN (x) / COTAN (x)) ^ 2
> 
> _______________________________________________
> Speakup mailing list
> Speakup@braille.uwo.ca
> http://speech.braille.uwo.ca/mailman/listinfo/speakup

-- 

Janina Sajka				Phone: +1.240.715.1272
Partner, Capital Accessibility LLC	http://www.CapitalAccessibility.Com

Marketing the Owasys 22C talking screenless cell phone in the U.S. and Canada--Go to http://www.ScreenlessPhone.Com to learn more.

Chair, Accessibility Workgroup		Free Standards Group (FSG)
janina@freestandards.org		http://a11y.org

Re: Routing Multiple Inbound IP Addresses -- How?

[Jim Kutsch]

Janina,
How are you doing the testing?  Do you have an IP address outside your 
OpenWRT-controlled network from which you are testing?  If not, I'd be happy 
to help from the outside

Jim Kutsch
Morristown, NJ


----- Original Message ----- 
From: "Janina Sajka" <janina@rednote.net>
To: "Speakup is a screen review system for Linux." <speakup@braille.uwo.ca>
Sent: Wednesday, November 30, 2005 13:28
Subject: Re: Routing Multiple Inbound IP Addresses -- How?


appreciate the thought, but routing is OK.

PS: The device where I'm trying to do all this is a Linksys WRT54gs
running OpenWRT. So, I've got all the great Linux tools natively on the
box -- except Speakup and the kitchen sink.

Ralph W. Reid writes:
> The discussions here seem to cover the iptables commands pretty well
> (based on my limited experience with this kind of thing).  However,
> once the addresses are translated, how are you routing the packets to
> your LAN?  If the translated addresses are not routed anywhere
> (perhaps via `route'), then there seems to be no way to make a
> connection to the systems.  I am largely guessing at this point (no
> flames please), but if no routing has been established for the
> internal addresses, then perhaps no connections are actually being
> established.  Run `route' from a command line on the machine connected
> to your MODEM with no parameters to see if there are any routes to
> your LAN addresses.  If not, then route can be used to establish some
> as follows:
>
> route add -host 192.168.0.1 eth1
> route add -host 192.168.0.2 eth2
> route add -net 10.0.0.0/8 eth2
>
> HTH, and have a _great_ day.
>
> On Wed, Nov 30, 2005 at 08:39:37AM -0700, Dawes, Stephen wrote:
> > Not necessary, and don't know the effects if you do.
> >
> >
> >
> > Steve Dawes
> > Phone: (403) 268-5527
> > Email: SDawes@calgary.ca
> >
> >
> >
> > NOTICE -
> > This communication is intended ONLY for the use of the person or entity 
> > named above and may contain information that is confidential or legally 
> > privileged. If you are not the intended recipient named above or a 
> > person responsible for delivering messages or communications to the 
> > intended recipient, YOU ARE HEREBY NOTIFIED that any use, distribution, 
> > or copying of this communication or any of the information contained in 
> > it is strictly prohibited. If you have received this communication in 
> > error, please notify us immediately by telephone and then destroy or 
> > delete this communication, or return it to us by mail if requested by 
> > us. The City of Calgary thanks you for your attention and cooperation.
> >
> > -----Original Message-----
> > From: speakup-bounces@braille.uwo.ca
> > [mailto:speakup-bounces@braille.uwo.ca] On Behalf Of Janina Sajka
> > Sent: 2005 November 29 6:37 PM
> > To: Speakup is a screen review system for Linux.
> > Subject: Re: Routing Multiple Inbound IP Addresses -- How?
> >
> > Do I also need to accept explicitly, some version of:
> >
> > iptables -t filter -A FORWARD -j ACCEPT
> >
> >
> > Or is that superfluous?
> >
> >
> > _______________________________________________
> > Speakup mailing list
> > Speakup@braille.uwo.ca
> > http://speech.braille.uwo.ca/mailman/listinfo/speakup
>
> -- 
> Ralph.  N6BNO.  Wisdom comes from central processing, not from I/O.
> rreid@sunset.net  http://personalweb.sunset.net/~rreid
> ...passing through The City of Internet at the speed of light!
> SEC (x) / COSEC (x) = (TAN (x) / COTAN (x)) ^ 2
>
> _______________________________________________
> Speakup mailing list
> Speakup@braille.uwo.ca
> http://speech.braille.uwo.ca/mailman/listinfo/speakup

-- 

Janina Sajka Phone: +1.240.715.1272
Partner, Capital Accessibility LLC http://www.CapitalAccessibility.Com

Marketing the Owasys 22C talking screenless cell phone in the U.S. and 
Canada--Go to http://www.ScreenlessPhone.Com to learn more.

Chair, Accessibility Workgroup Free Standards Group (FSG)
janina@freestandards.org http://a11y.org

_______________________________________________
Speakup mailing list
Speakup@braille.uwo.ca
http://speech.braille.uwo.ca/mailman/listinfo/speakup

Re: Routing Multiple Inbound IP Addresses -- How?

[Janina Sajka]

Thanks, Jim. But, yes, I access from an outside machine.

Jim Kutsch writes:
> Janina,
> How are you doing the testing?  Do you have an IP address outside your 
> OpenWRT-controlled network from which you are testing?  If not, I'd be happy 
> to help from the outside
> 
> Jim Kutsch
> Morristown, NJ
> 
> 
> ----- Original Message ----- 
> From: "Janina Sajka" <janina@rednote.net>
> To: "Speakup is a screen review system for Linux." <speakup@braille.uwo.ca>
> Sent: Wednesday, November 30, 2005 13:28
> Subject: Re: Routing Multiple Inbound IP Addresses -- How?
> 
> 
> appreciate the thought, but routing is OK.
> 
> PS: The device where I'm trying to do all this is a Linksys WRT54gs
> running OpenWRT. So, I've got all the great Linux tools natively on the
> box -- except Speakup and the kitchen sink.
> 
> Ralph W. Reid writes:
> > The discussions here seem to cover the iptables commands pretty well
> > (based on my limited experience with this kind of thing).  However,
> > once the addresses are translated, how are you routing the packets to
> > your LAN?  If the translated addresses are not routed anywhere
> > (perhaps via `route'), then there seems to be no way to make a
> > connection to the systems.  I am largely guessing at this point (no
> > flames please), but if no routing has been established for the
> > internal addresses, then perhaps no connections are actually being
> > established.  Run `route' from a command line on the machine connected
> > to your MODEM with no parameters to see if there are any routes to
> > your LAN addresses.  If not, then route can be used to establish some
> > as follows:
> >
> > route add -host 192.168.0.1 eth1
> > route add -host 192.168.0.2 eth2
> > route add -net 10.0.0.0/8 eth2
> >
> > HTH, and have a _great_ day.
> >
> > On Wed, Nov 30, 2005 at 08:39:37AM -0700, Dawes, Stephen wrote:
> > > Not necessary, and don't know the effects if you do.
> > >
> > >
> > >
> > > Steve Dawes
> > > Phone: (403) 268-5527
> > > Email: SDawes@calgary.ca
> > >
> > >
> > >
> > > NOTICE -
> > > This communication is intended ONLY for the use of the person or entity 
> > > named above and may contain information that is confidential or legally 
> > > privileged. If you are not the intended recipient named above or a 
> > > person responsible for delivering messages or communications to the 
> > > intended recipient, YOU ARE HEREBY NOTIFIED that any use, distribution, 
> > > or copying of this communication or any of the information contained in 
> > > it is strictly prohibited. If you have received this communication in 
> > > error, please notify us immediately by telephone and then destroy or 
> > > delete this communication, or return it to us by mail if requested by 
> > > us. The City of Calgary thanks you for your attention and cooperation.
> > >
> > > -----Original Message-----
> > > From: speakup-bounces@braille.uwo.ca
> > > [mailto:speakup-bounces@braille.uwo.ca] On Behalf Of Janina Sajka
> > > Sent: 2005 November 29 6:37 PM
> > > To: Speakup is a screen review system for Linux.
> > > Subject: Re: Routing Multiple Inbound IP Addresses -- How?
> > >
> > > Do I also need to accept explicitly, some version of:
> > >
> > > iptables -t filter -A FORWARD -j ACCEPT
> > >
> > >
> > > Or is that superfluous?
> > >
> > >
> > > _______________________________________________
> > > Speakup mailing list
> > > Speakup@braille.uwo.ca
> > > http://speech.braille.uwo.ca/mailman/listinfo/speakup
> >
> > -- 
> > Ralph.  N6BNO.  Wisdom comes from central processing, not from I/O.
> > rreid@sunset.net  http://personalweb.sunset.net/~rreid
> > ...passing through The City of Internet at the speed of light!
> > SEC (x) / COSEC (x) = (TAN (x) / COTAN (x)) ^ 2
> >
> > _______________________________________________
> > Speakup mailing list
> > Speakup@braille.uwo.ca
> > http://speech.braille.uwo.ca/mailman/listinfo/speakup
> 
> -- 
> 
> Janina Sajka Phone: +1.240.715.1272
> Partner, Capital Accessibility LLC http://www.CapitalAccessibility.Com
> 
> Marketing the Owasys 22C talking screenless cell phone in the U.S. and 
> Canada--Go to http://www.ScreenlessPhone.Com to learn more.
> 
> Chair, Accessibility Workgroup Free Standards Group (FSG)
> janina@freestandards.org http://a11y.org
> 
> _______________________________________________
> Speakup mailing list
> Speakup@braille.uwo.ca
> http://speech.braille.uwo.ca/mailman/listinfo/speakup
> 
> 
> 
> _______________________________________________
> Speakup mailing list
> Speakup@braille.uwo.ca
> http://speech.braille.uwo.ca/mailman/listinfo/speakup

-- 

Janina Sajka				Phone: +1.240.715.1272
Partner, Capital Accessibility LLC	http://www.CapitalAccessibility.Com

Marketing the Owasys 22C talking screenless cell phone in the U.S. and Canada--Go to http://www.ScreenlessPhone.Com to learn more.

Chair, Accessibility Workgroup		Free Standards Group (FSG)
janina@freestandards.org		http://a11y.org

Re: Routing Multiple Inbound IP Addresses -- How?

[Gregory Nowak]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I was envisioning you doing this on a box with 2 physical
nics. However, if you're doing this on a dsl modem, which has one nic,
then the problem may be that since the modem has no nic
configured with a 192.168.x.x address, it knows nothing about the
class c range of destination addresses, which it is supposed to route
the external addresses to, thus the problem.

Just something I thought might be worth pointing out.

Greg


On Wed, Nov 30, 2005 at 01:28:32PM -0500, Janina Sajka wrote:
> appreciate the thought, but routing is OK.
> 
> PS: The device where I'm trying to do all this is a Linksys WRT54gs
> running OpenWRT. So, I've got all the great Linux tools natively on the
> box -- except Speakup and the kitchen sink.
> 

- -- 
Free domains: http://www.eu.org/ or mail dns-manager@EU.org

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQFDjmTs7s9z/XlyUyARAqSYAJ9Rgytak+I6F4K4vUfvXbj29S3zBgCgkYSK
853HPyexkbI+tZpy+HuieXs=
=o2EF
-----END PGP SIGNATURE-----

Re: Routing Multiple Inbound IP Addresses -- How?

[Janina Sajka]

I'm doing this on the Linksys WRT54gs using OpenWRT
(http://www.openwrt.org). This box is a combination wireless access
point and wired router. It's currently configured to bridge the wireless
and the four 10/100 ethernet ports, though it is possible to split them
up. The fifth RJ45 port is the uplink port. I've been using NAT on this
box since January quite well, but only on a port by port basis. Still,
I've been able to do things like send traffic incoming on port 25 to
192.168.x.1, and traffic on port 4569 to 192.168.x.2.

So, the box can do it, I'm sure. I have also gotten it to accept
multiple addresses on its WAN port. Unfortunately, I did not test any
further last night. Will try again this evening.

Gregory Nowak writes:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> I was envisioning you doing this on a box with 2 physical
> nics. However, if you're doing this on a dsl modem, which has one nic,
> then the problem may be that since the modem has no nic
> configured with a 192.168.x.x address, it knows nothing about the
> class c range of destination addresses, which it is supposed to route
> the external addresses to, thus the problem.
> 
> Just something I thought might be worth pointing out.
> 
> Greg
> 
> 
> On Wed, Nov 30, 2005 at 01:28:32PM -0500, Janina Sajka wrote:
> > appreciate the thought, but routing is OK.
> > 
> > PS: The device where I'm trying to do all this is a Linksys WRT54gs
> > running OpenWRT. So, I've got all the great Linux tools natively on the
> > box -- except Speakup and the kitchen sink.
> > 
> 
> - -- 
> Free domains: http://www.eu.org/ or mail dns-manager@EU.org
> 
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.0.7 (GNU/Linux)
> 
> iD8DBQFDjmTs7s9z/XlyUyARAqSYAJ9Rgytak+I6F4K4vUfvXbj29S3zBgCgkYSK
> 853HPyexkbI+tZpy+HuieXs=
> =o2EF
> -----END PGP SIGNATURE-----
> 
> _______________________________________________
> Speakup mailing list
> Speakup@braille.uwo.ca
> http://speech.braille.uwo.ca/mailman/listinfo/speakup

-- 

Janina Sajka				Phone: +1.240.715.1272
Partner, Capital Accessibility LLC	http://www.CapitalAccessibility.Com

Marketing the Owasys 22C talking screenless cell phone in the U.S. and Canada--Go to http://www.ScreenlessPhone.Com to learn more.

Chair, Accessibility Workgroup		Free Standards Group (FSG)
janina@freestandards.org		http://a11y.org

Re: Routing Multiple Inbound IP Addresses -- How?

[Janina Sajka]

Dawes, Stephen writes:
> The problem that you may be having is that you have not initialized your
> nic with all of the external ip-addresses. eth0:0 for the first one, and
> eth0:1 for the next in line etc.
> Eth0 is the interface, and the :X indicates all of the locations for the
> ipaddresses.  

Duh, stick head in pail of water twice and pull out once.

But of course. I didn't do this before restarting iptables with the new
rules. Will remedy and test tonight.

PS: I don't want to do this during the day because the box serves my
business, including my phones.

> A friend of mine has done what you are trying to do on his ip-tables. I
> can see if he wants to share his set-up with us. The only problem is he
> is out of town until next Monday.


No problem. If this is still an issue Monday, I will appreciate his
wisdom. Thanks.

			Janina

RE: Routing Multiple Inbound IP Addresses -- How?

[Dawes, Stephen]

No, because you are dealing with pre-routing. The accept is typically
used as destination for the packet if it is not being otherwise
processed.

The problem that you may be having is that you have not initialized your
nic with all of the external ip-addresses. eth0:0 for the first one, and
eth0:1 for the next in line etc.
Eth0 is the interface, and the :X indicates all of the locations for the
ipaddresses.  
A friend of mine has done what you are trying to do on his ip-tables. I
can see if he wants to share his set-up with us. The only problem is he
is out of town until next Monday.

Let me know if you want me to pursue this angle.


Steve Dawes
Phone: (403) 268-5527
Email: SDawes@calgary.ca
 
 


NOTICE -
This communication is intended ONLY for the use of the person or entity named above and may contain information that is confidential or legally privileged. If you are not the intended recipient named above or a person responsible for delivering messages or communications to the intended recipient, YOU ARE HEREBY NOTIFIED that any use, distribution, or copying of this communication or any of the information contained in it is strictly prohibited. If you have received this communication in error, please notify us immediately by telephone and then destroy or delete this communication, or return it to us by mail if requested by us. The City of Calgary thanks you for your attention and cooperation.

Re: Routing Multiple Inbound IP Addresses -- How?

[Gregory Nowak]

On Tue, Nov 29, 2005 at 08:55:08PM -0500, Janina Sajka wrote:
> OK. So, I tried this, with my correct addresses, of course. It didn't
> work. 
> 

Did you get any errors from iptables? If not, then have you looked at
the output of

iptables -t nat -n -L

to get an idea of how iptables interprets your current rule sets in
the nat table? Iptables does what it does very well once you've got it
set up, but getting things set up properly and debugged is no walk in
the park.

> In the iptables rules I note that there are rules to accept responses
> for anything that originated on the inside. Do I maybe need similar
> rules for packets that originated on the outside via these addresses? In
> order that the response can be forwarded back out over the Internet?
> 

Hmmm, you might. I'm not sure though if the definitive response here
is yes, or no. I'll need to consider it, or maybe someone will beat me
to it with a definite answer to that question.

Greg



-- 
Free domains: http://www.eu.org/ or mail dns-manager@EU.org

Re: Routing Multiple Inbound IP Addresses -- How?

[Janina Sajka]

OK. So, I tried this, with my correct addresses, of course. It didn't
work. 

Only one service port was showing on an nmap.

Attempts to ssh to one machine got a "refused." Attempts to go to
another just sat there with no responce. I Ctrl-C'd out.


In the iptables rules I note that there are rules to accept responses
for anything that originated on the inside. Do I maybe need similar
rules for packets that originated on the outside via these addresses? In
order that the response can be forwarded back out over the Internet?


Gregory Nowak writes:
> Ok, I think I see what you're going for.
> 
> In the below examples, I assume that you have an external ip, 1.2.3.4,
> which you want to route to 192.168.0.1, and a second external ip,
> 5.6.7.8, that you want to route to 192.168.0.2. I also assume that
> your network device connected to the dsl modem is eth0.
> 
> iptables -t nat -A PREROUTING -i eth0 --source 1.2.3.4 -j DNAT
> --to-destination 192.168.0.1
> 
> and
> 
> iptables -t nat -A PREROUTING -i eth0 --source 5.6.7.8 -j DNAT
> --to-destination 192.168.0.2
> 
> Note 1:, I know I'm using incorrect number ranges for the external ip
> addresses.
> 
> Note 2: This might have line wrapped, so be sure to check for that if
> doing cut and paste.
> 
> Note 3: I obviously haven't tested this, but it should work in theory,
> as far as I understand iptables syntax. If you get errors, let me or
> the list know, and I'll try to resolve them. Hth.
> 
> Greg

Re: Routing Multiple Inbound IP Addresses -- How?

[Janina Sajka]

Do I also need to accept explicitly, some version of:

iptables -t filter -A FORWARD -j ACCEPT


Or is that superfluous?


Dawes, Stephen writes:
> My understanding of iptables, the -i eth0 is not necessary when you are
> specifying a source ip address.
> 
> iptables -t nat -A PREROUTING --source 1.2.3.4 -j DNAT --to-destination
> 192.168.0.1
> 
> and
> 
> iptables -t nat -A PREROUTING --source 5.6.7.8 -j DNAT --to-destination
> 192.168.0.2
> 
> The only need to identify the interface, -i eth0, is when you want to
> tell iptables to only look for information on a specific device.
> A case in point is that you should never see any 10.x.x.x or 192.168.x.x
> source ip addresses if eth0 is connect to the internet only.
> 
> Of course this all changes if you are behind a firewall router.
> 
> 
> Steve Dawes
> Phone: (403) 268-5527
> Email: SDawes@calgary.ca
>  
>  
> 
> 
> NOTICE -
> This communication is intended ONLY for the use of the person or entity named above and may contain information that is confidential or legally privileged. If you are not the intended recipient named above or a person responsible for delivering messages or communications to the intended recipient, YOU ARE HEREBY NOTIFIED that any use, distribution, or copying of this communication or any of the information contained in it is strictly prohibited. If you have received this communication in error, please notify us immediately by telephone and then destroy or delete this communication, or return it to us by mail if requested by us. The City of Calgary thanks you for your attention and cooperation.
> 
> 
> _______________________________________________
> Speakup mailing list
> Speakup@braille.uwo.ca
> http://speech.braille.uwo.ca/mailman/listinfo/speakup

-- 

Janina Sajka				Phone: +1.240.715.1272
Partner, Capital Accessibility LLC	http://www.CapitalAccessibility.Com

Marketing the Owasys 22C talking screenless cell phone in the U.S. and Canada--Go to http://www.ScreenlessPhone.Com to learn more.

Chair, Accessibility Workgroup		Free Standards Group (FSG)
janina@freestandards.org		http://a11y.org

Re: Routing Multiple Inbound IP Addresses -- How?

[Janina Sajka]

Cool, Gregory. I'll check this out and report back. It does sound like
what I'm looking for. Thanks.

Gregory Nowak writes:
> Ok, I think I see what you're going for.
> 
> In the below examples, I assume that you have an external ip, 1.2.3.4,
> which you want to route to 192.168.0.1, and a second external ip,
> 5.6.7.8, that you want to route to 192.168.0.2. I also assume that
> your network device connected to the dsl modem is eth0.
> 
> iptables -t nat -A PREROUTING -i eth0 --source 1.2.3.4 -j DNAT
> --to-destination 192.168.0.1
> 
> and
> 
> iptables -t nat -A PREROUTING -i eth0 --source 5.6.7.8 -j DNAT
> --to-destination 192.168.0.2
> 
> Note 1:, I know I'm using incorrect number ranges for the external ip
> addresses.
> 
> Note 2: This might have line wrapped, so be sure to check for that if
> doing cut and paste.
> 
> Note 3: I obviously haven't tested this, but it should work in theory,
> as far as I understand iptables syntax. If you get errors, let me or
> the list know, and I'll try to resolve them. Hth.
> 
> Greg
> 
> 
> On Tue, Nov 29, 2005 at 08:24:37AM -0500, Janina Sajka wrote:
> > Hi, Sina:
> > 
> > Didn't remember the term multihoming. I'll check that out.
> > 
> > So, here's my situation. My ISP provides me multiple ip addresses, if I
> > want them. I want to take advantage of that in a way I think is
> > appropriate. It would be easy if I just used the external, routable ip
> > addresses directly--one for each machine perhaps.
> > 
> > But, I want to keep my internal, nonroutable scheme intact. For one
> > thing, I have more machines than routable addresses. For another thing,
> > I'd like the freedom to use the routables by function, rather than
> > specific machine, meaning that I might migrate internally from one
> > machine to another at some point, without changing the externals.
> > 
> > So, how do I do that NAT? Let's say I have four IP addresses. They're
> > discontinguous. Internally, I have seven or eight machines (depending on
> > the day).
> > 
> > Here's what I know I can do. I can route traffic arriving on address A
> > port 80 to machine A-Prime port 80, and route traffic arriving on
> > address B port 80 to machine B-Prime.
> > 
> > But, can I route traffic arriving on address C, whatever port, to
> > machine C-Prime? Without specifying all the particular ports one at a
> > time? Or as some kind of gargantuan range like 1-32767?
> > 
> 
> 
> -- 
> Free domains: http://www.eu.org/ or mail dns-manager@EU.org
> 
> 
> _______________________________________________
> Speakup mailing list
> Speakup@braille.uwo.ca
> http://speech.braille.uwo.ca/mailman/listinfo/speakup

-- 

Janina Sajka				Phone: +1.240.715.1272
Partner, Capital Accessibility LLC	http://www.CapitalAccessibility.Com

Marketing the Owasys 22C talking screenless cell phone in the U.S. and Canada--Go to http://www.ScreenlessPhone.Com to learn more.

Chair, Accessibility Workgroup		Free Standards Group (FSG)
janina@freestandards.org		http://a11y.org

RE: Routing Multiple Inbound IP Addresses -- How?

[Dawes, Stephen]

My understanding of iptables, the -i eth0 is not necessary when you are
specifying a source ip address.

iptables -t nat -A PREROUTING --source 1.2.3.4 -j DNAT --to-destination
192.168.0.1

and

iptables -t nat -A PREROUTING --source 5.6.7.8 -j DNAT --to-destination
192.168.0.2

The only need to identify the interface, -i eth0, is when you want to
tell iptables to only look for information on a specific device.
A case in point is that you should never see any 10.x.x.x or 192.168.x.x
source ip addresses if eth0 is connect to the internet only.

Of course this all changes if you are behind a firewall router.


Steve Dawes
Phone: (403) 268-5527
Email: SDawes@calgary.ca
 
 


NOTICE -
This communication is intended ONLY for the use of the person or entity named above and may contain information that is confidential or legally privileged. If you are not the intended recipient named above or a person responsible for delivering messages or communications to the intended recipient, YOU ARE HEREBY NOTIFIED that any use, distribution, or copying of this communication or any of the information contained in it is strictly prohibited. If you have received this communication in error, please notify us immediately by telephone and then destroy or delete this communication, or return it to us by mail if requested by us. The City of Calgary thanks you for your attention and cooperation.

Re: Routing Multiple Inbound IP Addresses -- How?

[Gregory Nowak]

Ok, I think I see what you're going for.

In the below examples, I assume that you have an external ip, 1.2.3.4,
which you want to route to 192.168.0.1, and a second external ip,
5.6.7.8, that you want to route to 192.168.0.2. I also assume that
your network device connected to the dsl modem is eth0.

iptables -t nat -A PREROUTING -i eth0 --source 1.2.3.4 -j DNAT
--to-destination 192.168.0.1

and

iptables -t nat -A PREROUTING -i eth0 --source 5.6.7.8 -j DNAT
--to-destination 192.168.0.2

Note 1:, I know I'm using incorrect number ranges for the external ip
addresses.

Note 2: This might have line wrapped, so be sure to check for that if
doing cut and paste.

Note 3: I obviously haven't tested this, but it should work in theory,
as far as I understand iptables syntax. If you get errors, let me or
the list know, and I'll try to resolve them. Hth.

Greg


On Tue, Nov 29, 2005 at 08:24:37AM -0500, Janina Sajka wrote:
> Hi, Sina:
> 
> Didn't remember the term multihoming. I'll check that out.
> 
> So, here's my situation. My ISP provides me multiple ip addresses, if I
> want them. I want to take advantage of that in a way I think is
> appropriate. It would be easy if I just used the external, routable ip
> addresses directly--one for each machine perhaps.
> 
> But, I want to keep my internal, nonroutable scheme intact. For one
> thing, I have more machines than routable addresses. For another thing,
> I'd like the freedom to use the routables by function, rather than
> specific machine, meaning that I might migrate internally from one
> machine to another at some point, without changing the externals.
> 
> So, how do I do that NAT? Let's say I have four IP addresses. They're
> discontinguous. Internally, I have seven or eight machines (depending on
> the day).
> 
> Here's what I know I can do. I can route traffic arriving on address A
> port 80 to machine A-Prime port 80, and route traffic arriving on
> address B port 80 to machine B-Prime.
> 
> But, can I route traffic arriving on address C, whatever port, to
> machine C-Prime? Without specifying all the particular ports one at a
> time? Or as some kind of gargantuan range like 1-32767?
> 


-- 
Free domains: http://www.eu.org/ or mail dns-manager@EU.org

RE: Routing Multiple Inbound IP Addresses -- How?

[Sina Bahram]

Aha, I got you.

Ok, I need to look at iptables  rules, since I'm not up on them, but yes ...
This is possible.

Basically, what you want to do is have a gateway to more than one IP. This
is the inverse of a multicast IP which sends information that it receives to
multiple IP's, you sore of want it the other way ... Multiple IP's get
information but they go to a central location; however, you want to retain
the information of which IP it was sent to.

Now, I do have one question still. You do want to use NAT, correct? So at no
point in time do you want these computers to have public IP's? except of
course for your gateway ... Is that correct?

The reason I ask this is because it's the difference between talking about
pass throughs, and talking about redirection.

Take care,
Sina

-----Original Message-----
From: speakup-bounces@braille.uwo.ca [mailto:speakup-bounces@braille.uwo.ca]
On Behalf Of Janina Sajka
Sent: Tuesday, November 29, 2005 8:25 AM
To: Speakup is a screen review system for Linux.
Subject: Re: Routing Multiple Inbound IP Addresses -- How?

Hi, Sina:

Didn't remember the term multihoming. I'll check that out.

So, here's my situation. My ISP provides me multiple ip addresses, if I want
them. I want to take advantage of that in a way I think is appropriate. It
would be easy if I just used the external, routable ip addresses
directly--one for each machine perhaps.

But, I want to keep my internal, nonroutable scheme intact. For one thing, I
have more machines than routable addresses. For another thing, I'd like the
freedom to use the routables by function, rather than specific machine,
meaning that I might migrate internally from one machine to another at some
point, without changing the externals.

So, how do I do that NAT? Let's say I have four IP addresses. They're
discontinguous. Internally, I have seven or eight machines (depending on the
day).

Here's what I know I can do. I can route traffic arriving on address A port
80 to machine A-Prime port 80, and route traffic arriving on address B port
80 to machine B-Prime.

But, can I route traffic arriving on address C, whatever port, to machine
C-Prime? Without specifying all the particular ports one at a time? Or as
some kind of gargantuan range like 1-32767?

Sina Bahram writes:
> Hi Janina,
> 
> Can you provide a little more information.
> 
> When you say over your dsl, do you mean that your dsl modem is going 
> to be assigning more than one IP address to you? If so, then you're 
> wanting something like multihoming, although if you want to pass those 
> IP's along, as you said, they are routable ... Then that's a different
situation.
> 
> Could you explain the specifics in greater detail please?
> 
> Take care,
> Sina
> 
> -----Original Message-----
> From: speakup-bounces@braille.uwo.ca 
> [mailto:speakup-bounces@braille.uwo.ca]
> On Behalf Of Janina Sajka
> Sent: Monday, November 28, 2005 10:12 PM
> To: speakup@braille.uwo.ca; ma-linux@tux.org; 
> blinux-list-bounces@redhat.com
> Subject: Routing Multiple Inbound IP Addresses -- How?
> 
> This is fairly basic, I'm sure. But, for the life of me, I can't find 
> documentation on it.
> 
> So, here's the situation ...
> 
> I have several routable IP addresses. All of them need to come through 
> the same interface, over my DSL to be specific. So, how can I route 
> based on IP alone? I know how to route by port, but how do I do it by IP
address?
> 
> All examples/help much appreciated.
> 
> 
> --
> 
> Janina Sajka				Phone: +1.240.715.1272
> Partner, Capital Accessibility LLC	http://www.CapitalAccessibility.Com
> 
> Marketing the Owasys 22C talking screenless cell phone in the U.S. and 
> Canada--Go to http://www.ScreenlessPhone.Com to learn more.
> 
> Chair, Accessibility Workgroup		Free Standards Group (FSG)
> janina@freestandards.org		http://a11y.org
> 
> _______________________________________________
> Speakup mailing list
> Speakup@braille.uwo.ca
> http://speech.braille.uwo.ca/mailman/listinfo/speakup
> 
> 
> _______________________________________________
> Speakup mailing list
> Speakup@braille.uwo.ca
> http://speech.braille.uwo.ca/mailman/listinfo/speakup

-- 

Janina Sajka				Phone: +1.240.715.1272
Partner, Capital Accessibility LLC	http://www.CapitalAccessibility.Com

Marketing the Owasys 22C talking screenless cell phone in the U.S. and
Canada--Go to http://www.ScreenlessPhone.Com to learn more.

Chair, Accessibility Workgroup		Free Standards Group (FSG)
janina@freestandards.org		http://a11y.org

_______________________________________________
Speakup mailing list
Speakup@braille.uwo.ca
http://speech.braille.uwo.ca/mailman/listinfo/speakup

Re: Routing Multiple Inbound IP Addresses -- How?

[Janina Sajka]

Hi, Sina:

Didn't remember the term multihoming. I'll check that out.

So, here's my situation. My ISP provides me multiple ip addresses, if I
want them. I want to take advantage of that in a way I think is
appropriate. It would be easy if I just used the external, routable ip
addresses directly--one for each machine perhaps.

But, I want to keep my internal, nonroutable scheme intact. For one
thing, I have more machines than routable addresses. For another thing,
I'd like the freedom to use the routables by function, rather than
specific machine, meaning that I might migrate internally from one
machine to another at some point, without changing the externals.

So, how do I do that NAT? Let's say I have four IP addresses. They're
discontinguous. Internally, I have seven or eight machines (depending on
the day).

Here's what I know I can do. I can route traffic arriving on address A
port 80 to machine A-Prime port 80, and route traffic arriving on
address B port 80 to machine B-Prime.

But, can I route traffic arriving on address C, whatever port, to
machine C-Prime? Without specifying all the particular ports one at a
time? Or as some kind of gargantuan range like 1-32767?

Sina Bahram writes:
> Hi Janina,
> 
> Can you provide a little more information.
> 
> When you say over your dsl, do you mean that your dsl modem is going to be
> assigning more than one IP address to you? If so, then you're wanting
> something like multihoming, although if you want to pass those IP's along,
> as you said, they are routable ... Then that's a different situation.
> 
> Could you explain the specifics in greater detail please?
> 
> Take care,
> Sina
> 
> -----Original Message-----
> From: speakup-bounces@braille.uwo.ca [mailto:speakup-bounces@braille.uwo.ca]
> On Behalf Of Janina Sajka
> Sent: Monday, November 28, 2005 10:12 PM
> To: speakup@braille.uwo.ca; ma-linux@tux.org; blinux-list-bounces@redhat.com
> Subject: Routing Multiple Inbound IP Addresses -- How?
> 
> This is fairly basic, I'm sure. But, for the life of me, I can't find
> documentation on it.
> 
> So, here's the situation ...
> 
> I have several routable IP addresses. All of them need to come through the
> same interface, over my DSL to be specific. So, how can I route based on IP
> alone? I know how to route by port, but how do I do it by IP address?
> 
> All examples/help much appreciated.
> 
> 
> -- 
> 
> Janina Sajka				Phone: +1.240.715.1272
> Partner, Capital Accessibility LLC	http://www.CapitalAccessibility.Com
> 
> Marketing the Owasys 22C talking screenless cell phone in the U.S. and
> Canada--Go to http://www.ScreenlessPhone.Com to learn more.
> 
> Chair, Accessibility Workgroup		Free Standards Group (FSG)
> janina@freestandards.org		http://a11y.org
> 
> _______________________________________________
> Speakup mailing list
> Speakup@braille.uwo.ca
> http://speech.braille.uwo.ca/mailman/listinfo/speakup
> 
> 
> _______________________________________________
> Speakup mailing list
> Speakup@braille.uwo.ca
> http://speech.braille.uwo.ca/mailman/listinfo/speakup

-- 

Janina Sajka				Phone: +1.240.715.1272
Partner, Capital Accessibility LLC	http://www.CapitalAccessibility.Com

Marketing the Owasys 22C talking screenless cell phone in the U.S. and Canada--Go to http://www.ScreenlessPhone.Com to learn more.

Chair, Accessibility Workgroup		Free Standards Group (FSG)
janina@freestandards.org		http://a11y.org

Re: Routing Multiple Inbound IP Addresses -- How?

[Travis Siegel]

I'm not 100% sure what you're asking here.  If you just want the ips  
to come into your box, all you need do is have your dns server tie  
all your ips to your box.  If you do not run your own dns server,  
then this is still doable, but it becomes slightly more difficult.   
On the other hand, if you're just asking for multi-ip access via  
apache, or sendmail, this can be done in their configurations.

However, I don't think this is what you're asking.  I think what  
you're asking, is how to make your machine see itself as multiple  
ips.  (192.168.1.1 refer to yoour machine, and 192.168.1.2, and so on).
This is easily done using a modified netconfig script.  When you boot  
your machine, netconfig runs a script that puts eth0 (in most cases  
it's eth0) into your routing table, and sets it up with a particular  
address.
To make it see multiple ips, you need only copy the netconfig script  
(it's in /etc/rc.d/rc.inet2) I think at least on slackware, your  
mileage will vary depending on your version of linux.
In any case, you'll need to change the hardware each ip address  
refers to.  Your first one can remain eth0, but all others will need  
to refer to eth0:1 eth0:2 eth0:3 eth0:4 and so on until all ips are  
mapped to your ethernet port.  Of course, you would replace eth0 with  
whatever interface you're using for your internet connection.
I used to do this for softcon when I had 8 routable ips, and wasn't  
using them all.  The provider used to check, and they had a habbit of  
taking back those ips not specifically being used for things, so I  
simply multicasted them all to the same box while they weren't being  
used for other servers.
I have scripts somewhere, but I believe you should have little or no  
trouble figuring it out from this message, though I can offer  
additional assistance if you run into problems getting it to work.

On Nov 28, 2005, at 11:13 PM, Sina Bahram wrote:

> Hi Janina,
>
> Can you provide a little more information.
>
> When you say over your dsl, do you mean that your dsl modem is  
> going to be
> assigning more than one IP address to you? If so, then you're wanting
> something like multihoming, although if you want to pass those IP's  
> along,
> as you said, they are routable ... Then that's a different situation.
>
> Could you explain the specifics in greater detail please?
>
> Take care,
> Sina
>
> -----Original Message-----
> From: speakup-bounces@braille.uwo.ca [mailto:speakup- 
> bounces@braille.uwo.ca]
> On Behalf Of Janina Sajka
> Sent: Monday, November 28, 2005 10:12 PM
> To: speakup@braille.uwo.ca; ma-linux@tux.org; blinux-list- 
> bounces@redhat.com
> Subject: Routing Multiple Inbound IP Addresses -- How?
>
> This is fairly basic, I'm sure. But, for the life of me, I can't find
> documentation on it.
>
> So, here's the situation ...
>
> I have several routable IP addresses. All of them need to come  
> through the
> same interface, over my DSL to be specific. So, how can I route  
> based on IP
> alone? I know how to route by port, but how do I do it by IP address?
>
> All examples/help much appreciated.
>
>
> -- 
>
> Janina Sajka                Phone: +1.240.715.1272
> Partner, Capital Accessibility LLC    http:// 
> www.CapitalAccessibility.Com
>
> Marketing the Owasys 22C talking screenless cell phone in the U.S. and
> Canada--Go to http://www.ScreenlessPhone.Com to learn more.
>
> Chair, Accessibility Workgroup        Free Standards Group (FSG)
> janina@freestandards.org        http://a11y.org
>
> _______________________________________________
> Speakup mailing list
> Speakup@braille.uwo.ca
> http://speech.braille.uwo.ca/mailman/listinfo/speakup
>
>
> _______________________________________________
> Speakup mailing list
> Speakup@braille.uwo.ca
> http://speech.braille.uwo.ca/mailman/listinfo/speakup
>

RE: Routing Multiple Inbound IP Addresses -- How?

[Sina Bahram]

Hi Janina,

Can you provide a little more information.

When you say over your dsl, do you mean that your dsl modem is going to be
assigning more than one IP address to you? If so, then you're wanting
something like multihoming, although if you want to pass those IP's along,
as you said, they are routable ... Then that's a different situation.

Could you explain the specifics in greater detail please?

Take care,
Sina

-----Original Message-----
From: speakup-bounces@braille.uwo.ca [mailto:speakup-bounces@braille.uwo.ca]
On Behalf Of Janina Sajka
Sent: Monday, November 28, 2005 10:12 PM
To: speakup@braille.uwo.ca; ma-linux@tux.org; blinux-list-bounces@redhat.com
Subject: Routing Multiple Inbound IP Addresses -- How?

This is fairly basic, I'm sure. But, for the life of me, I can't find
documentation on it.

So, here's the situation ...

I have several routable IP addresses. All of them need to come through the
same interface, over my DSL to be specific. So, how can I route based on IP
alone? I know how to route by port, but how do I do it by IP address?

All examples/help much appreciated.


-- 

Janina Sajka				Phone: +1.240.715.1272
Partner, Capital Accessibility LLC	http://www.CapitalAccessibility.Com

Marketing the Owasys 22C talking screenless cell phone in the U.S. and
Canada--Go to http://www.ScreenlessPhone.Com to learn more.

Chair, Accessibility Workgroup		Free Standards Group (FSG)
janina@freestandards.org		http://a11y.org

_______________________________________________
Speakup mailing list
Speakup@braille.uwo.ca
http://speech.braille.uwo.ca/mailman/listinfo/speakup

Routing Multiple Inbound IP Addresses -- How?

[Janina Sajka]

This is fairly basic, I'm sure. But, for the life of me, I can't find
documentation on it.

So, here's the situation ...

I have several routable IP addresses. All of them need to come through
the same interface, over my DSL to be specific. So, how can I route
based on IP alone? I know how to route by port, but how do I do it by IP
address?

All examples/help much appreciated.


-- 

Janina Sajka				Phone: +1.240.715.1272
Partner, Capital Accessibility LLC	http://www.CapitalAccessibility.Com

Marketing the Owasys 22C talking screenless cell phone in the U.S. and Canada--Go to http://www.ScreenlessPhone.Com to learn more.

Chair, Accessibility Workgroup		Free Standards Group (FSG)
janina@freestandards.org		http://a11y.org