Why does my NAT setup only work properly from time to time?
Homework assignment...
There are 3 computers in a local network: 192.168.0.185 (the 'client'), 192.168.0.129 (the 'gateway') and 192.168.0.81 (the 'server'). The 'server' is running a HTTP server, so typing 192.168.0.81 in a browser's address bar from any of the other two computers displays a webpage.
The assignment is to set up NAT in the so-called 'gateway' in such a way that typing its IP address (192.168.0.129) in the 'client's browser will display the webpage served by the 'server'. This is my solution attempt:
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A PREROUTING -p tcp -d 192.168.0.129 --dport 80 -j DNAT --to 192.168.0.81:80
iptables -t nat -A POSTROUTING -p tcp -d 192.168.0.81 --dport 80 -j SNAT --to 192.168.0.129:80
This (I hoped) would make the 'gateway' redirect requests made to it to the 'server' (DNAT) while substituting source address of the request to its own so that the 'server' will correctly send the response through the 'gateway' and not straightly to the 'client' (SNAT).
I typed the 'gateway's IP in the 'client's browser's address bar. Hooray! I saw the webpage! I thought I was done!
Except I wasn't. I then reloaded the page on the 'client'. And I got timeout error. I reloaded the page once again. Timeout again. I waited a teeny tiny bit and reloaded once again. This page the webpage was served correctly. So I reloaded for the final time and... timeout.
This confuses me. It seems that once a page is served things stop working for a while. Why is that happening? Where is my mistake?
I should note that typing the 'server's address in the 'client's browser (as opposed to typing the 'gateway's address) does not cause such problems.
networking iptables nat
asked Jan 16 at 4:00
gaazkamgaazkam
3781515
add a comment |
Homework assignment...
There are 3 computers in a local network: 192.168.0.185 (the 'client'), 192.168.0.129 (the 'gateway') and 192.168.0.81 (the 'server'). The 'server' is running a HTTP server, so typing 192.168.0.81 in a browser's address bar from any of the other two computers displays a webpage.
The assignment is to set up NAT in the so-called 'gateway' in such a way that typing its IP address (192.168.0.129) in the 'client's browser will display the webpage served by the 'server'. This is my solution attempt:
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A PREROUTING -p tcp -d 192.168.0.129 --dport 80 -j DNAT --to 192.168.0.81:80
iptables -t nat -A POSTROUTING -p tcp -d 192.168.0.81 --dport 80 -j SNAT --to 192.168.0.129:80
This (I hoped) would make the 'gateway' redirect requests made to it to the 'server' (DNAT) while substituting source address of the request to its own so that the 'server' will correctly send the response through the 'gateway' and not straightly to the 'client' (SNAT).
I typed the 'gateway's IP in the 'client's browser's address bar. Hooray! I saw the webpage! I thought I was done!
Except I wasn't. I then reloaded the page on the 'client'. And I got timeout error. I reloaded the page once again. Timeout again. I waited a teeny tiny bit and reloaded once again. This page the webpage was served correctly. So I reloaded for the final time and... timeout.
This confuses me. It seems that once a page is served things stop working for a while. Why is that happening? Where is my mistake?
I should note that typing the 'server's address in the 'client's browser (as opposed to typing the 'gateway's address) does not cause such problems.
networking iptables nat
asked Jan 16 at 4:00
gaazkamgaazkam
3781515
could be a problem with the web server
– jsotola
Jan 16 at 4:03
@jsotola I don't think so; please see the edited question.
– gaazkam
Jan 16 at 4:07
@jsotola Because the assignment says I have to configure the 'gateway' in such a way to make this possible.
– gaazkam
Jan 16 at 4:11
The way to debug this is to usetcpdumporwiresharkon all network interfaces that may be interesting, and look at which packets go where, and what is happening to them. (1) If all 3 computers are connected to a single switch, watch out for ICMP REDIRECT messages which will take the gateway out of the loop. (2) You don't have to use both SNAT and DNAT; the connection tracker will take care of SNAT.
– dirkt
Jan 16 at 7:46
@dirkt Wrt SNAT: I was trying to remove this and things stopped working completely. I think the server was trying to send its responses omitting the 'gateway' then.
– gaazkam
Jan 16 at 8:21
add a comment |
Homework assignment...
There are 3 computers in a local network: 192.168.0.185 (the 'client'), 192.168.0.129 (the 'gateway') and 192.168.0.81 (the 'server'). The 'server' is running a HTTP server, so typing 192.168.0.81 in a browser's address bar from any of the other two computers displays a webpage.
The assignment is to set up NAT in the so-called 'gateway' in such a way that typing its IP address (192.168.0.129) in the 'client's browser will display the webpage served by the 'server'. This is my solution attempt:
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A PREROUTING -p tcp -d 192.168.0.129 --dport 80 -j DNAT --to 192.168.0.81:80
iptables -t nat -A POSTROUTING -p tcp -d 192.168.0.81 --dport 80 -j SNAT --to 192.168.0.129:80
This (I hoped) would make the 'gateway' redirect requests made to it to the 'server' (DNAT) while substituting source address of the request to its own so that the 'server' will correctly send the response through the 'gateway' and not straightly to the 'client' (SNAT).
I typed the 'gateway's IP in the 'client's browser's address bar. Hooray! I saw the webpage! I thought I was done!
Except I wasn't. I then reloaded the page on the 'client'. And I got timeout error. I reloaded the page once again. Timeout again. I waited a teeny tiny bit and reloaded once again. This page the webpage was served correctly. So I reloaded for the final time and... timeout.
This confuses me. It seems that once a page is served things stop working for a while. Why is that happening? Where is my mistake?
I should note that typing the 'server's address in the 'client's browser (as opposed to typing the 'gateway's address) does not cause such problems.
networking iptables nat
asked Jan 16 at 4:00
gaazkamgaazkam
3781515
Homework assignment...
There are 3 computers in a local network: 192.168.0.185 (the 'client'), 192.168.0.129 (the 'gateway') and 192.168.0.81 (the 'server'). The 'server' is running a HTTP server, so typing 192.168.0.81 in a browser's address bar from any of the other two computers displays a webpage.
The assignment is to set up NAT in the so-called 'gateway' in such a way that typing its IP address (192.168.0.129) in the 'client's browser will display the webpage served by the 'server'. This is my solution attempt:
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A PREROUTING -p tcp -d 192.168.0.129 --dport 80 -j DNAT --to 192.168.0.81:80
iptables -t nat -A POSTROUTING -p tcp -d 192.168.0.81 --dport 80 -j SNAT --to 192.168.0.129:80
This (I hoped) would make the 'gateway' redirect requests made to it to the 'server' (DNAT) while substituting source address of the request to its own so that the 'server' will correctly send the response through the 'gateway' and not straightly to the 'client' (SNAT).
I typed the 'gateway's IP in the 'client's browser's address bar. Hooray! I saw the webpage! I thought I was done!
Except I wasn't. I then reloaded the page on the 'client'. And I got timeout error. I reloaded the page once again. Timeout again. I waited a teeny tiny bit and reloaded once again. This page the webpage was served correctly. So I reloaded for the final time and... timeout.
This confuses me. It seems that once a page is served things stop working for a while. Why is that happening? Where is my mistake?
I should note that typing the 'server's address in the 'client's browser (as opposed to typing the 'gateway's address) does not cause such problems.
networking iptables nat
networking iptables nat
asked Jan 16 at 4:00
gaazkamgaazkam
3781515
asked Jan 16 at 4:00
gaazkamgaazkam
3781515
edited Jan 16 at 4:06
gaazkam
asked Jan 16 at 4:00
gaazkamgaazkam
3781515
asked Jan 16 at 4:00
gaazkamgaazkam
3781515
asked Jan 16 at 4:00
gaazkamgaazkam
3781515
3781515
could be a problem with the web server
– jsotola
Jan 16 at 4:03
@jsotola I don't think so; please see the edited question.
– gaazkam
Jan 16 at 4:07
@jsotola Because the assignment says I have to configure the 'gateway' in such a way to make this possible.
– gaazkam
Jan 16 at 4:11
The way to debug this is to usetcpdumporwiresharkon all network interfaces that may be interesting, and look at which packets go where, and what is happening to them. (1) If all 3 computers are connected to a single switch, watch out for ICMP REDIRECT messages which will take the gateway out of the loop. (2) You don't have to use both SNAT and DNAT; the connection tracker will take care of SNAT.
– dirkt
Jan 16 at 7:46
@dirkt Wrt SNAT: I was trying to remove this and things stopped working completely. I think the server was trying to send its responses omitting the 'gateway' then.
– gaazkam
Jan 16 at 8:21
add a comment |
could be a problem with the web server
– jsotola
Jan 16 at 4:03
@jsotola I don't think so; please see the edited question.
– gaazkam
Jan 16 at 4:07
@jsotola Because the assignment says I have to configure the 'gateway' in such a way to make this possible.
– gaazkam
Jan 16 at 4:11
The way to debug this is to usetcpdumporwiresharkon all network interfaces that may be interesting, and look at which packets go where, and what is happening to them. (1) If all 3 computers are connected to a single switch, watch out for ICMP REDIRECT messages which will take the gateway out of the loop. (2) You don't have to use both SNAT and DNAT; the connection tracker will take care of SNAT.
– dirkt
Jan 16 at 7:46
@dirkt Wrt SNAT: I was trying to remove this and things stopped working completely. I think the server was trying to send its responses omitting the 'gateway' then.
– gaazkam
Jan 16 at 8:21
could be a problem with the web server
– jsotola
Jan 16 at 4:03
could be a problem with the web server
– jsotola
Jan 16 at 4:03
@jsotola I don't think so; please see the edited question.
– gaazkam
Jan 16 at 4:07
@jsotola I don't think so; please see the edited question.
– gaazkam
Jan 16 at 4:07
@jsotola Because the assignment says I have to configure the 'gateway' in such a way to make this possible.
– gaazkam
Jan 16 at 4:11
@jsotola Because the assignment says I have to configure the 'gateway' in such a way to make this possible.
– gaazkam
Jan 16 at 4:11
The way to debug this is to use
tcpdump or wireshark on all network interfaces that may be interesting, and look at which packets go where, and what is happening to them. (1) If all 3 computers are connected to a single switch, watch out for ICMP REDIRECT messages which will take the gateway out of the loop. (2) You don't have to use both SNAT and DNAT; the connection tracker will take care of SNAT.– dirkt
Jan 16 at 7:46
The way to debug this is to use
tcpdump or wireshark on all network interfaces that may be interesting, and look at which packets go where, and what is happening to them. (1) If all 3 computers are connected to a single switch, watch out for ICMP REDIRECT messages which will take the gateway out of the loop. (2) You don't have to use both SNAT and DNAT; the connection tracker will take care of SNAT.– dirkt
Jan 16 at 7:46
@dirkt Wrt SNAT: I was trying to remove this and things stopped working completely. I think the server was trying to send its responses omitting the 'gateway' then.
– gaazkam
Jan 16 at 8:21
@dirkt Wrt SNAT: I was trying to remove this and things stopped working completely. I think the server was trying to send its responses omitting the 'gateway' then.
– gaazkam
Jan 16 at 8:21
add a comment |
2 Answers
2
active
oldest
votes
I think I got it finally. The culprit was this line:
iptables -t nat -A POSTROUTING -p tcp -d 192.168.0.81 --dport 80 -j SNAT --to 192.168.0.129:80
Things started working when I changed it to this:
iptables -t nat -A POSTROUTING -p tcp -d 192.168.0.81 --dport 80 -j SNAT --to 192.168.0.129
Not sure why but I have a vague idea that NAT uses ports to identify connections. So specifying only one port was leading into conflicts when there was more than 1 request.
answered Jan 16 at 8:24
gaazkamgaazkam
3781515
You nailed it: NAT HOWTO - Mappings In Depth see "Implicit Source Port Mapping" and "What Happens When NAT Fails". You can use theconntrackcommand (with options -L or -E) to see what's going on
– A.B
Jan 17 at 1:42
add a comment |
I have a PC with Debian, serving as router and may share some experience with you.
Routing
If you are intentionally using host as a router, dont ever do
echo 1 > /proc/sys/net/ipv4/ip_forward
Instead do either:
sysctl -w net.ipv4.ip_forward=1
nano /etc/sysctl.conf:
- and edit
net.ipv4.ip_forward = 1
- and edit
Forwarding
Oh I've just noticed that you can offer following stuff all almost without magic. That's just the production answer - its up to you now to dig inside configurations (google shorewall sources - then you will know how iptables parsers/generators work)
Next I can advise some webmin web interface to play with it - you access 192.168.0.81:10000 Now you have no reason to learn command line - all iptables stuff is now done through web interface! ;) Also read its shell scripts and know now, how production things are working!
Logging
webmin did all stuff, but if you are on debian and want a console log - just type apt install iftop (google iftop sources, read, educate)
Feel free to like and accept this post, if you found my time and this info useful!
answered Jan 16 at 5:46
xakepp35xakepp35
1107
New contributor
xakepp35 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Why should I never doecho 1 > /proc/sys/net/ipv4/ip_forward?
– gaazkam
Jan 16 at 6:09
@gaazkam because it has a standart way of defining default-behaviour of defining that at a boot time, having that setting ready "on" and not waiting your custom script or shell to interacting, to run specific router-init stuff at system init!!! Read the answer, stop inventing things alredy invented at century ago))
– xakepp35
Jan 16 at 6:19
I'm sorry but I don't think I'm allowed to use tools like Shorewall or Webmin, just vanilla iptables I'm afraid ;/ Also - Im terribly sorry, but I feel reading source code of these tools is... kind of overkillish if my goal is just to set up NAT for a single time
– gaazkam
Jan 16 at 6:20
those are mutually exclusive things. If you want to learn topic - you have to look at "what to be done as per today" - what binaries and utilities are availble - that's at least. Good if you could examinate their source code, surface level at least
– xakepp35
Jan 16 at 6:23
If you dont want to learn topic - pay a bribe to an educator and never appear here anymore)))
– xakepp35
Jan 16 at 6:23
|
show 5 more comments
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f494721%2fwhy-does-my-nat-setup-only-work-properly-from-time-to-time%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
I think I got it finally. The culprit was this line:
iptables -t nat -A POSTROUTING -p tcp -d 192.168.0.81 --dport 80 -j SNAT --to 192.168.0.129:80
Things started working when I changed it to this:
iptables -t nat -A POSTROUTING -p tcp -d 192.168.0.81 --dport 80 -j SNAT --to 192.168.0.129
Not sure why but I have a vague idea that NAT uses ports to identify connections. So specifying only one port was leading into conflicts when there was more than 1 request.
answered Jan 16 at 8:24
gaazkamgaazkam
3781515
You nailed it: NAT HOWTO - Mappings In Depth see "Implicit Source Port Mapping" and "What Happens When NAT Fails". You can use theconntrackcommand (with options -L or -E) to see what's going on
– A.B
Jan 17 at 1:42
add a comment |
I think I got it finally. The culprit was this line:
iptables -t nat -A POSTROUTING -p tcp -d 192.168.0.81 --dport 80 -j SNAT --to 192.168.0.129:80
Things started working when I changed it to this:
iptables -t nat -A POSTROUTING -p tcp -d 192.168.0.81 --dport 80 -j SNAT --to 192.168.0.129
Not sure why but I have a vague idea that NAT uses ports to identify connections. So specifying only one port was leading into conflicts when there was more than 1 request.
answered Jan 16 at 8:24
gaazkamgaazkam
3781515
You nailed it: NAT HOWTO - Mappings In Depth see "Implicit Source Port Mapping" and "What Happens When NAT Fails". You can use theconntrackcommand (with options -L or -E) to see what's going on
– A.B
Jan 17 at 1:42
add a comment |
I think I got it finally. The culprit was this line:
iptables -t nat -A POSTROUTING -p tcp -d 192.168.0.81 --dport 80 -j SNAT --to 192.168.0.129:80
Things started working when I changed it to this:
iptables -t nat -A POSTROUTING -p tcp -d 192.168.0.81 --dport 80 -j SNAT --to 192.168.0.129
Not sure why but I have a vague idea that NAT uses ports to identify connections. So specifying only one port was leading into conflicts when there was more than 1 request.
answered Jan 16 at 8:24
gaazkamgaazkam
3781515
I think I got it finally. The culprit was this line:
iptables -t nat -A POSTROUTING -p tcp -d 192.168.0.81 --dport 80 -j SNAT --to 192.168.0.129:80
Things started working when I changed it to this:
iptables -t nat -A POSTROUTING -p tcp -d 192.168.0.81 --dport 80 -j SNAT --to 192.168.0.129
Not sure why but I have a vague idea that NAT uses ports to identify connections. So specifying only one port was leading into conflicts when there was more than 1 request.
answered Jan 16 at 8:24
gaazkamgaazkam
3781515
answered Jan 16 at 8:24
gaazkamgaazkam
3781515
answered Jan 16 at 8:24
gaazkamgaazkam
3781515
answered Jan 16 at 8:24
gaazkamgaazkam
3781515
3781515
You nailed it: NAT HOWTO - Mappings In Depth see "Implicit Source Port Mapping" and "What Happens When NAT Fails". You can use theconntrackcommand (with options -L or -E) to see what's going on
– A.B
Jan 17 at 1:42
add a comment |
You nailed it: NAT HOWTO - Mappings In Depth see "Implicit Source Port Mapping" and "What Happens When NAT Fails". You can use theconntrackcommand (with options -L or -E) to see what's going on
– A.B
Jan 17 at 1:42
You nailed it: NAT HOWTO - Mappings In Depth see "Implicit Source Port Mapping" and "What Happens When NAT Fails". You can use the
conntrack command (with options -L or -E) to see what's going on– A.B
Jan 17 at 1:42
You nailed it: NAT HOWTO - Mappings In Depth see "Implicit Source Port Mapping" and "What Happens When NAT Fails". You can use the
conntrack command (with options -L or -E) to see what's going on– A.B
Jan 17 at 1:42
add a comment |
I have a PC with Debian, serving as router and may share some experience with you.
Routing
If you are intentionally using host as a router, dont ever do
echo 1 > /proc/sys/net/ipv4/ip_forward
Instead do either:
sysctl -w net.ipv4.ip_forward=1
nano /etc/sysctl.conf:
- and edit
net.ipv4.ip_forward = 1
- and edit
Forwarding
Oh I've just noticed that you can offer following stuff all almost without magic. That's just the production answer - its up to you now to dig inside configurations (google shorewall sources - then you will know how iptables parsers/generators work)
Next I can advise some webmin web interface to play with it - you access 192.168.0.81:10000 Now you have no reason to learn command line - all iptables stuff is now done through web interface! ;) Also read its shell scripts and know now, how production things are working!
Logging
webmin did all stuff, but if you are on debian and want a console log - just type apt install iftop (google iftop sources, read, educate)
Feel free to like and accept this post, if you found my time and this info useful!
answered Jan 16 at 5:46
xakepp35xakepp35
1107
New contributor
xakepp35 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Why should I never doecho 1 > /proc/sys/net/ipv4/ip_forward?
– gaazkam
Jan 16 at 6:09
@gaazkam because it has a standart way of defining default-behaviour of defining that at a boot time, having that setting ready "on" and not waiting your custom script or shell to interacting, to run specific router-init stuff at system init!!! Read the answer, stop inventing things alredy invented at century ago))
– xakepp35
Jan 16 at 6:19
I'm sorry but I don't think I'm allowed to use tools like Shorewall or Webmin, just vanilla iptables I'm afraid ;/ Also - Im terribly sorry, but I feel reading source code of these tools is... kind of overkillish if my goal is just to set up NAT for a single time
– gaazkam
Jan 16 at 6:20
those are mutually exclusive things. If you want to learn topic - you have to look at "what to be done as per today" - what binaries and utilities are availble - that's at least. Good if you could examinate their source code, surface level at least
– xakepp35
Jan 16 at 6:23
If you dont want to learn topic - pay a bribe to an educator and never appear here anymore)))
– xakepp35
Jan 16 at 6:23
|
show 5 more comments
I have a PC with Debian, serving as router and may share some experience with you.
Routing
If you are intentionally using host as a router, dont ever do
echo 1 > /proc/sys/net/ipv4/ip_forward
Instead do either:
sysctl -w net.ipv4.ip_forward=1
nano /etc/sysctl.conf:
- and edit
net.ipv4.ip_forward = 1
- and edit
Forwarding
Oh I've just noticed that you can offer following stuff all almost without magic. That's just the production answer - its up to you now to dig inside configurations (google shorewall sources - then you will know how iptables parsers/generators work)
Next I can advise some webmin web interface to play with it - you access 192.168.0.81:10000 Now you have no reason to learn command line - all iptables stuff is now done through web interface! ;) Also read its shell scripts and know now, how production things are working!
Logging
webmin did all stuff, but if you are on debian and want a console log - just type apt install iftop (google iftop sources, read, educate)
Feel free to like and accept this post, if you found my time and this info useful!
answered Jan 16 at 5:46
xakepp35xakepp35
1107
New contributor
xakepp35 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Why should I never doecho 1 > /proc/sys/net/ipv4/ip_forward?
– gaazkam
Jan 16 at 6:09
@gaazkam because it has a standart way of defining default-behaviour of defining that at a boot time, having that setting ready "on" and not waiting your custom script or shell to interacting, to run specific router-init stuff at system init!!! Read the answer, stop inventing things alredy invented at century ago))
– xakepp35
Jan 16 at 6:19
I'm sorry but I don't think I'm allowed to use tools like Shorewall or Webmin, just vanilla iptables I'm afraid ;/ Also - Im terribly sorry, but I feel reading source code of these tools is... kind of overkillish if my goal is just to set up NAT for a single time
– gaazkam
Jan 16 at 6:20
those are mutually exclusive things. If you want to learn topic - you have to look at "what to be done as per today" - what binaries and utilities are availble - that's at least. Good if you could examinate their source code, surface level at least
– xakepp35
Jan 16 at 6:23
If you dont want to learn topic - pay a bribe to an educator and never appear here anymore)))
– xakepp35
Jan 16 at 6:23
|
show 5 more comments
I have a PC with Debian, serving as router and may share some experience with you.
Routing
If you are intentionally using host as a router, dont ever do
echo 1 > /proc/sys/net/ipv4/ip_forward
Instead do either:
sysctl -w net.ipv4.ip_forward=1
nano /etc/sysctl.conf:
- and edit
net.ipv4.ip_forward = 1
- and edit
Forwarding
Oh I've just noticed that you can offer following stuff all almost without magic. That's just the production answer - its up to you now to dig inside configurations (google shorewall sources - then you will know how iptables parsers/generators work)
Next I can advise some webmin web interface to play with it - you access 192.168.0.81:10000 Now you have no reason to learn command line - all iptables stuff is now done through web interface! ;) Also read its shell scripts and know now, how production things are working!
Logging
webmin did all stuff, but if you are on debian and want a console log - just type apt install iftop (google iftop sources, read, educate)
Feel free to like and accept this post, if you found my time and this info useful!
answered Jan 16 at 5:46
xakepp35xakepp35
1107
New contributor
xakepp35 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
I have a PC with Debian, serving as router and may share some experience with you.
Routing
If you are intentionally using host as a router, dont ever do
echo 1 > /proc/sys/net/ipv4/ip_forward
Instead do either:
sysctl -w net.ipv4.ip_forward=1
nano /etc/sysctl.conf:
- and edit
net.ipv4.ip_forward = 1
- and edit
Forwarding
Oh I've just noticed that you can offer following stuff all almost without magic. That's just the production answer - its up to you now to dig inside configurations (google shorewall sources - then you will know how iptables parsers/generators work)
Next I can advise some webmin web interface to play with it - you access 192.168.0.81:10000 Now you have no reason to learn command line - all iptables stuff is now done through web interface! ;) Also read its shell scripts and know now, how production things are working!
Logging
webmin did all stuff, but if you are on debian and want a console log - just type apt install iftop (google iftop sources, read, educate)
Feel free to like and accept this post, if you found my time and this info useful!
answered Jan 16 at 5:46
xakepp35xakepp35
1107
New contributor
xakepp35 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
edited Jan 16 at 6:12
answered Jan 16 at 5:46
xakepp35xakepp35
1107
New contributor
xakepp35 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
answered Jan 16 at 5:46
xakepp35xakepp35
1107
answered Jan 16 at 5:46
xakepp35xakepp35
1107
1107
New contributor
xakepp35 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
New contributor
xakepp35 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
xakepp35 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Why should I never doecho 1 > /proc/sys/net/ipv4/ip_forward?
– gaazkam
Jan 16 at 6:09
@gaazkam because it has a standart way of defining default-behaviour of defining that at a boot time, having that setting ready "on" and not waiting your custom script or shell to interacting, to run specific router-init stuff at system init!!! Read the answer, stop inventing things alredy invented at century ago))
– xakepp35
Jan 16 at 6:19
I'm sorry but I don't think I'm allowed to use tools like Shorewall or Webmin, just vanilla iptables I'm afraid ;/ Also - Im terribly sorry, but I feel reading source code of these tools is... kind of overkillish if my goal is just to set up NAT for a single time
– gaazkam
Jan 16 at 6:20
those are mutually exclusive things. If you want to learn topic - you have to look at "what to be done as per today" - what binaries and utilities are availble - that's at least. Good if you could examinate their source code, surface level at least
– xakepp35
Jan 16 at 6:23
If you dont want to learn topic - pay a bribe to an educator and never appear here anymore)))
– xakepp35
Jan 16 at 6:23
|
show 5 more comments
Why should I never doecho 1 > /proc/sys/net/ipv4/ip_forward?
– gaazkam
Jan 16 at 6:09
@gaazkam because it has a standart way of defining default-behaviour of defining that at a boot time, having that setting ready "on" and not waiting your custom script or shell to interacting, to run specific router-init stuff at system init!!! Read the answer, stop inventing things alredy invented at century ago))
– xakepp35
Jan 16 at 6:19
I'm sorry but I don't think I'm allowed to use tools like Shorewall or Webmin, just vanilla iptables I'm afraid ;/ Also - Im terribly sorry, but I feel reading source code of these tools is... kind of overkillish if my goal is just to set up NAT for a single time
– gaazkam
Jan 16 at 6:20
those are mutually exclusive things. If you want to learn topic - you have to look at "what to be done as per today" - what binaries and utilities are availble - that's at least. Good if you could examinate their source code, surface level at least
– xakepp35
Jan 16 at 6:23
If you dont want to learn topic - pay a bribe to an educator and never appear here anymore)))
– xakepp35
Jan 16 at 6:23
Why should I never do
echo 1 > /proc/sys/net/ipv4/ip_forward?– gaazkam
Jan 16 at 6:09
Why should I never do
echo 1 > /proc/sys/net/ipv4/ip_forward?– gaazkam
Jan 16 at 6:09
@gaazkam because it has a standart way of defining default-behaviour of defining that at a boot time, having that setting ready "on" and not waiting your custom script or shell to interacting, to run specific router-init stuff at system init!!! Read the answer, stop inventing things alredy invented at century ago))
– xakepp35
Jan 16 at 6:19
@gaazkam because it has a standart way of defining default-behaviour of defining that at a boot time, having that setting ready "on" and not waiting your custom script or shell to interacting, to run specific router-init stuff at system init!!! Read the answer, stop inventing things alredy invented at century ago))
– xakepp35
Jan 16 at 6:19
I'm sorry but I don't think I'm allowed to use tools like Shorewall or Webmin, just vanilla iptables I'm afraid ;/ Also - Im terribly sorry, but I feel reading source code of these tools is... kind of overkillish if my goal is just to set up NAT for a single time
– gaazkam
Jan 16 at 6:20
I'm sorry but I don't think I'm allowed to use tools like Shorewall or Webmin, just vanilla iptables I'm afraid ;/ Also - Im terribly sorry, but I feel reading source code of these tools is... kind of overkillish if my goal is just to set up NAT for a single time
– gaazkam
Jan 16 at 6:20
those are mutually exclusive things. If you want to learn topic - you have to look at "what to be done as per today" - what binaries and utilities are availble - that's at least. Good if you could examinate their source code, surface level at least
– xakepp35
Jan 16 at 6:23
those are mutually exclusive things. If you want to learn topic - you have to look at "what to be done as per today" - what binaries and utilities are availble - that's at least. Good if you could examinate their source code, surface level at least
– xakepp35
Jan 16 at 6:23
If you dont want to learn topic - pay a bribe to an educator and never appear here anymore)))
– xakepp35
Jan 16 at 6:23
If you dont want to learn topic - pay a bribe to an educator and never appear here anymore)))
– xakepp35
Jan 16 at 6:23
|
show 5 more comments
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f494721%2fwhy-does-my-nat-setup-only-work-properly-from-time-to-time%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
could be a problem with the web server
– jsotola
Jan 16 at 4:03
@jsotola I don't think so; please see the edited question.
– gaazkam
Jan 16 at 4:07
@jsotola Because the assignment says I have to configure the 'gateway' in such a way to make this possible.
– gaazkam
Jan 16 at 4:11
The way to debug this is to use
tcpdumporwiresharkon all network interfaces that may be interesting, and look at which packets go where, and what is happening to them. (1) If all 3 computers are connected to a single switch, watch out for ICMP REDIRECT messages which will take the gateway out of the loop. (2) You don't have to use both SNAT and DNAT; the connection tracker will take care of SNAT.– dirkt
Jan 16 at 7:46
@dirkt Wrt SNAT: I was trying to remove this and things stopped working completely. I think the server was trying to send its responses omitting the 'gateway' then.
– gaazkam
Jan 16 at 8:21