[Firehol-support] NAT on vlan

[Costa Tsaousis]

Guy wrote:
> Hi guys,
>
> I've run into a little problem. I'm using firehol to successfully NAT
> traffic to a machine on our hosting company's LAN.
> I'm trying to do the same thing again, but there's a difference in the
> networks this time.
>
> The setup that works looks like this:
> ===
> masquerade eth1
> dnat to 10.0.7.120:8000 proto tcp dport 8000 inface eth1
> dnat to 10.0.7.120:80 proto tcp dport 80 inface eth1
> dnat to 10.0.7.120:22 proto tcp dport 22 inface eth1
> dnat to 10.0.7.120:25 proto tcp dport 25 inface eth1
>
> router internet2lan inface eth1 outface eth0
>         server bhttp1   accept  dst 10.0.7.120
>         server http     accept  dst 10.0.7.120
>         server ssh      accept  dst 10.0.7.120
>         server smtp     accept  dst 10.0.7.120
>         client all accept
> ===
> The LAN ip for the firehol server is 10.0.7.118/255.255.255.240.
>
> On the new setup that is failing, the LAN only server is
> 10.0.16.50/255.255.255.240 while the firehol server's LAN ip is
> 10.0.7.119/255.255.255.240.
> 10.0.7.119 can still ping 10.0.16.50 though. Is this something odd
> with VLANs or is there something obvious I'm not aware of?
>
> Thanks
> Guy
>
>   
10.0.7.119 can ping 10.0.16.50 probably because of 'client all accept'.
We don't have enough info to trace this down.

I suggest adding 'log DNAT' to each dnat roule and 'log ROUTE' to each 
server statement in the router and then just make a request and check 
you logs.

There should be both DNAT and ROUTE logs (this means firehol worked fine).

If you get only DNAT, without ROUTE, check the routing on the firehol host.

If you get both, but still it does not work, check the parameters logged 
together (IN= OUT= SRC= DST=, etc) to find out your routing issue.

If it works right you should get, for each connection, one DNAT and many 
ROUTE matching both ways of communication.
If you get one DNAT and only one ROUTE, the replies from your server to 
your client do not go back the same way they came in.

Costa