Re: GRE through NAT (linux iptables)

[Eric Vyncke <evyncke () cisco com>]

At 18:12 30/11/2002 -0700, Bob George wrote:
> I'm trying to set up a GRE tunnel through a NAT gateway as follows:

Even if I'm not a iptable specialist, here are two comments:
- GRE is IP protocol 47, so you cannot only translate on TCP/UDP ports
- be sure that C is defined to terminate the GRE tunnel on the external_ip

Else, it worked (but not with iptable)

Hope this helps

-eric


> 1. External GRE traffic arriving on the external interface of gateway A should be redirected to an inside interface on 
> B. The GRE tunnel endpoints are the remote system C and eth1 on B.
>
> 2. Traffic exiting machine A's external interface (eth1) should be NAT'd to the external IP of that interface.
>
> Hopefully this drawing will make everything clear:
>
>          eth1 +---+ eth2      eth1 +---+
>               |   | .254      .253 |   |
> C --- INTERNET -+ A +----- DMZ ------+ B |
> <external_ip> |   | 172.16.23.0/24 |   |
>               +---+                +---+
>               ^                    ^
>               NAT                  tunnel endpoint
> <----- GRE TUNNEL ---------------->
>
> I HAVE been able to:
>
> * Create GRE tunnels between C-A, and A-B with no problems.
> * Redirect other non-GRE inbound traffic on A eth1 to B eth1.
> * Connect from B to external systems with TCP, UDP & ICMP.
>
> I have tried various combinations of iptables configurations with no luck so far with GRE. Here are the relevant parts 
> of the configuration on A:
>
> --- cut here --- cut here ---
>
> iptables -P INPUT DROP
> iptables -P OUTPUT DROP
> iptables -P FORWARD DROP
>
> iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to
> iptables -N eth1-in
> iptables -A INPUT -i eth1 -j eth1-in
>
> # NAT B traffic - THESE WORK
> iptables -A eth1-in --protocol tcp -i eth1 --destination-port 8200:8202 -j ACCEPT
> iptables -t nat -A PREROUTING -i eth1 --protocol tcp --destination-port 8200:8202 -j DNAT --to 172.16.23.253
>
> # NAT inbound GRE traffic - THIS DOESN'T WORK
> iptables -A eth1-in --protocol 47 -i eth1 -j ACCEPT
> iptables -t nat -A PREROUTING -i eth1 --protocol 47 -j DNAT --to 172.16.23.253
>
> --- cut here --- cut here ---
>
> I have also configured A with basic rules NAT'ing all outbound traffic of eth1, and setting ALLOW policies for 
> FORWARD, INPUT and OUTPUT. I've also tried removing the DNAT and SNAT rules for GRE in various combinations. All other 
> traffic worked well, but still no GRE.
>
> I did some captures using tcpdump on both systems. I could see GRE traffic coming in to eth1 on A, and ICMP responses 
> from A to C indicating "protocol unreachable." I never saw the outbound GRE traffic going through NAT, though other 
> outbound traffic from B was fine.
>
> I've searched various howtos, and found numerous articles that make me think it should work easily, yet I'm stumped. 
> I'm curious if anyone has successfully done GRE via NAT. Am I (hopefully) misssing something obvious?
>
> Thanks,
>
> - Bob
>
>
> _______________________________________________
> firewall-wizards mailing list
> firewall-wizards () honor icsalabs com
> http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards