IP Masquerading works, but does not masquerade from within the local network

IP Masquerading works, but does not masquerade from within the local network

Post by Tim Aidle » Wed, 09 Aug 2000 04:00:00



I've got a box running Redhat 6.1 working as a gateway for our home network.
It's connected to a cable modem, and we've only got one IP address, so it's
doing IP forwarding and masquerading for us.

Now, consider this situation: I've got a * running on one of my windows
boxes, whose IP address is 192.168.0.1 (for instance). The * is on port
8888, and I've got the linux box set up to forward this port along from
port, say, 9999, using a line much like

ipmasqadm portfw -a -P tcp -L xxx.xxx.xxx.xxx 9999 -R 192.168.0.1 8888

in my rc.local.

This works very well for people connecting in from outside - they'd use a
URL like:

http://www.veryComputer.com/:9999/video/frame

but if I try and use that URL from inside the local network, it doesn't
connect, I'd have to use:

http://www.veryComputer.com/:8888/video/frame

which is rather annoying as it makes it difficult to test things (I have to
VNC out to work and boot up a browser there)

I'm fairly sure the problem isn't with the * software - I've had the
same problem when trying to connected to an apache server inside the network
as well.

any ideas?

cheers,

Tim


 
 
 

IP Masquerading works, but does not masquerade from within the local network

Post by Manfred Bart » Wed, 09 Aug 2000 04:00:00



> I've got a box running Redhat 6.1 working as a gateway for our home network.
> It's connected to a cable modem, and we've only got one IP address, so it's
> doing IP forwarding and masquerading for us.

> Now, consider this situation: I've got a * running on one of my windows
> boxes, whose IP address is 192.168.0.1 (for instance). The * is on port
> 8888, and I've got the linux box set up to forward this port along from
> port, say, 9999, using a line much like

> ipmasqadm portfw -a -P tcp -L xxx.xxx.xxx.xxx 9999 -R 192.168.0.1 8888

> in my rc.local.

> This works very well for people connecting in from outside - they'd use a
> URL like:

> http://www.veryComputer.com/:9999/video/frame

> but if I try and use that URL from inside the local network, it doesn't
> connect, I'd have to use:

> http://www.veryComputer.com/:8888/video/frame

> which is rather annoying as it makes it difficult to test things (I have to
> VNC out to work and boot up a browser there)

> I'm fairly sure the problem isn't with the * software - I've had the
> same problem when trying to connected to an apache server inside the network
> as well.

> any ideas?

The kernel on the masquerading box knows from the routing table and
interface specifications that xxx.xxx.xxx.xxx is local, so it never
goes through that interface.  If we assume that the masquerading box
is 192.168.0.99 than you could add another forwarding rule for the
internal interface:

ipmasqadm portfw -a -P tcp -L 192.168.0.99 9999 -R 192.168.0.1 8888

--
Manfred Bartz