1 |
Christian Parpart wrote: |
2 |
> Hi, |
3 |
> |
4 |
> we're about to move some services from an old host to a newer one, |
5 |
> however, we want to keep up the old host for a week after the migration, so, |
6 |
> that everyone may choose their own good time to switch their IP's in their |
7 |
> local configs. |
8 |
> |
9 |
> that is, I want to all IP packets incoming at $old_ip to be redirected to |
10 |
> $new_ip via iptables. |
11 |
> |
12 |
> unfortunately, in my little test, that didn't work '( |
13 |
> |
14 |
> Executing the following on the $old_ip's host. |
15 |
> |
16 |
> $ old_ip=public.ip.1 |
17 |
> $ new_ip=public.ip.2 |
18 |
> |
19 |
> $ iptables -t nat -A PREROUTING -p tcp --dport 81 \ |
20 |
> -d $old_ip -i eth0 -j DNAT --to-destination $new_ip:80 |
21 |
> $ iptables -t nat -A POSTROUTING -p tcp --sport 80 -\ |
22 |
> s $new_ip -o eth0 -j SNAT --to-source $old_ip:81 |
23 |
|
24 |
Try adding these and report success :-) |
25 |
|
26 |
$ iptables -t filter -I FORWARD -p tcp \ |
27 |
-d $old_ip --dport 81 -j ACCEPT |
28 |
$ iptables -t filter -I FORWARD -p tcp \ |
29 |
-s $new_ip --sport 80 -j ACCEPT |
30 |
|
31 |
Check if you neeed -i/o eth0. |
32 |
|
33 |
The general way to debug iptables for me is to add the same rule with |
34 |
-j LOG instead and then run this: |
35 |
|
36 |
watch -n1 -d 'for f in nat filter mangle; do echo -e "\n\n\t\tFILTER: $f\n"; iptables -t $f -L -nxv --line-numbers; done' |
37 |
|
38 |
or |
39 |
|
40 |
watch -n1 -d 'for f in nat filter mangle; do echo -e "\n\n\t\tFILTER: $f\n"; iptables -t $f -L -nxv --line-numbers; done |grep LOG' |
41 |
|
42 |
or |
43 |
|
44 |
watch -n1 -d 'for f in nat filter mangle; do echo -ne "\n\n:::\t$f\t:::\n"; iptables -t $f -L -nxv --line-numbers; done | egrep --after 1 "LOG|^Chain "' |
45 |
|
46 |
(Hmm, I am sending that for GWN Tips&Tricks!) |
47 |
|
48 |
> now, a $(telnet $old_ip:81) shall be equivalent to $(telnet $new_ip:80). |
49 |
> but it seems that no packet is reaching the $new_ip's host. |
50 |
> |
51 |
> So has anybody a nice hint for me where I ran into what pitfall? |
52 |
|
53 |
Your pitfall is very common: "not enough RTFM-ing" :-) |
54 |
|
55 |
Excerpt from: |
56 |
http://www.netfilter.org/documentation/HOWTO/netfilter-hacking-HOWTO-3.html |
57 |
|
58 |
=cut |
59 |
|
60 |
On the left is where packets come in: having passed the simple sanity |
61 |
checks (i.e., not truncated, IP checksum OK, not a promiscuous receive), |
62 |
they are passed to the netfilter framework's NF_IP_PRE_ROUTING [1] hook. |
63 |
|
64 |
Next they enter the routing code, which decides whether the packet is |
65 |
destined for another interface, or a local process. The routing code may |
66 |
drop packets that are unroutable. |
67 |
|
68 |
If it's destined to pass to another interface instead, the netfilter |
69 |
framework is called for the NF_IP_FORWARD [3] hook. |
70 |
|
71 |
=cut |
72 |
|
73 |
|
74 |
/me tries to contribute my 2 yen. |
75 |
|
76 |
Kalin. |
77 |
|
78 |
-- |
79 |
|[ ~~~~~~~~~~~~~~~~~~~~~~ ]| |
80 |
+-> http://ThinRope.net/ <-+ |
81 |
|[ ______________________ ]| |
82 |
|
83 |
-- |
84 |
gentoo-server@g.o mailing list |