Hello all,
I have been given the assignment to route a secure 30bit subnet to my internal 24bit subnet.
Unfortunatly I do not know how to decide which rules and conditions on which to place this route.
SNAT on prerouting, vs SNAT on postrouting, etc.
Thanks
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
thats interesting, I did not realize they were linked as SNAT in postroting and DNAT in Prerouting.
I was hoping to use it the other way.
I have to route (or something, I thought it was NAT) a 192.168.197.16/255.255.255
Is this possible to do?
Oh, also, the 192.168.197.16/30 can not be used or accessed as the gateway, it is a vpn subnet I have been assigned.
Thank you
> I was hoping to use it the other way.
There is no logic to use it the other way around. When the packet is received by the machine it can't be correctly routed if the destination IP is not yet known (wrong). That is why destination NAT must be done before routing - PREROUTING.
Similarly source address must be available when routing and filtering so source NAT is the very last step before packet leaves the machine - POSTROUTING.
> I have to route (or something, I thought it was NAT) a 192.168.197.16/255.255.255
You VPN to your network and are assigned an address 192.168.197.16/255.255.255
If you don't want to see address 192.168.197.16/60 in your internal network you could SNAT the packets to 10.4.245.0.
> Oh, also, the 192.168.197.16/30 can not be used or accessed as the gateway, it is a vpn subnet I have been assigned.
Why not? As I asked before - could you explain what you are trying to do. Your company network is 10.4.245.0/24, right. Are you trying to VPN out to some other location and are assigned 192.168.197.16/30 address or is someone VPNing to your network or what?
Hello,
Thank you Blaz, that link you sent has been very enlightening on how things work. I have been looking for a manual for a while.
Well here is the complete scenario. This VPN I am trying to route is a client side to a data vendor. I have been assigned these addresses by them. We receive data through this connection but they probably would get pissed if all of our gateway traffic diverts through their servers/internet connections.
the issue I am having is that they have told me what ip addresses that belong to what they call my "Encryption Domain(Subnet - Local Secure Group)"
I am trying to build this ipsec connection in an ipcop box and have gone as far as i know how, with no luck.
> This VPN I am trying to route is a client side to a data vendor.
> I have been assigned these addresses by them.
I assume that you will have to do SNAT then - from your network address (10.4.245.X) to assigned addresses (192.168.197.16). This is to make sure that all the reply packets know where they must go. Their network is probably not aware of your network addresses.
>We receive data through this connection but they probably would get
> pissed if all of our gateway traffic diverts through their servers/internet connections.
Not sure what you mean. You should only route traffic to destination 192.168.0.0/16 (or whatever their network is) through the VPN. All other traffic should go directly to the internet. On linux you can add routing rules with the following command:
ip route add 192.168.0.0/16 via 10.4.245.5
> the issue I am having is that they have told me what ip addresses that
> belong to what they call my "Encryption Domain(Subnet - Local Secure Group)"
As stated above I believe that you should be represented by these addresses whenever communicating with their network - you should SNAT.
> I am trying to build this ipsec connection in an ipcop box and have gone as far as i know how, with no luck.
I don't use ipcop so I am no expert there. You can have a look at:
http://www.ipcop.org/1.4.0
It is a fact that VPNs can be difficult to establish, especially if trying to do it between different products (ipcop to cisco or similar).
Well, after a lot of trial and error, I found that I only needed half a route, and the return just makes the entire system not work. the IPsec connection gives errors that packets are being ignored, but we have full connection and data is flowing both ways.
This will be my solution because the box has been in the production environment for 3 weeks now with no issues, or flaws.
Business Accounts
Answer for Membership
by: BlazPosted on 2009-03-26 at 00:29:19ID: 23987953
From your description I can't figure out what exactly you are trying to do.
If you want to do (just) routing this has nothing to do with SNAT and DNAT.
Otherwise - SNAT (NAT of source address) can be only done postrouting. DNAT (NAT of destination address) can be only done prerouting.
http://www.netfilter.org/d