Re: [gentoo-server] iptables NAT and service move from host to host

[Kalin KOZHUHAROV]

Christian Parpart wrote:
> Hi,
>
> we're about to move some services from an old host to a newer one,
> however, we want to keep up the old host for a week after the migration, so,
> that everyone may choose their own good time to switch their IP's in their
> local configs.
>
> that is, I want to all IP packets incoming at $old_ip to be redirected to
> $new_ip via iptables.
>
> unfortunately, in my little test, that didn't work '(
>
> Executing the following on the $old_ip's host.
>
> $ old_ip=public.ip.1
> $ new_ip=public.ip.2
>
> $ iptables -t nat -A PREROUTING  -p tcp --dport 81 \
> 	-d $old_ip -i eth0 -j DNAT --to-destination $new_ip:80
> $ iptables -t nat -A POSTROUTING -p tcp --sport 80 -\
> 	s $new_ip -o eth0 -j SNAT --to-source $old_ip:81

Try adding these and report success :-)

$ iptables -t filter -I FORWARD -p tcp \
	-d $old_ip --dport 81 -j ACCEPT
$ iptables -t filter -I FORWARD -p tcp \
	-s $new_ip --sport 80 -j ACCEPT

Check if you neeed -i/o eth0.

The general way to debug iptables for me is to add the same rule with
-j LOG instead and then run this:

watch -n1 -d 'for f in nat filter mangle; do echo -e "\n\n\t\tFILTER: $f\n"; iptables -t $f -L -nxv --line-numbers; done'

or

watch -n1 -d 'for f in nat filter mangle; do echo -e "\n\n\t\tFILTER: $f\n"; iptables -t $f -L -nxv --line-numbers; done |grep LOG'

or

watch -n1 -d 'for f in nat filter mangle; do echo -ne "\n\n:::\t$f\t:::\n"; iptables -t $f -L -nxv --line-numbers; done | egrep --after 1 "LOG|^Chain "'

(Hmm, I am sending that for GWN Tips&Tricks!)

> now, a $(telnet $old_ip:81) shall be equivalent to $(telnet $new_ip:80).
> but it seems that no packet is reaching the $new_ip's host.
>
> So has anybody a nice hint for me where I ran into what pitfall?

Your pitfall is very common: "not enough RTFM-ing" :-)

Excerpt from: 
	http://www.netfilter.org/documentation/HOWTO/netfilter-hacking-HOWTO-3.html

=cut

On the left is where packets come in: having passed the simple sanity
checks (i.e., not truncated, IP checksum OK, not a promiscuous receive),
they are passed to the netfilter framework's NF_IP_PRE_ROUTING [1] hook.

Next they enter the routing code, which decides whether the packet is
destined for another interface, or a local process. The routing code may
drop packets that are unroutable.

If it's destined to pass to another interface instead, the netfilter
framework is called for the NF_IP_FORWARD [3] hook.

=cut


/me tries to contribute my 2 yen.

Kalin.

-- 
|[ ~~~~~~~~~~~~~~~~~~~~~~ ]|
+-> http://ThinRope.net/ <-+
|[ ______________________ ]|

-- 
gentoo-server@g.o mailing list