From: Herbert Poetzl (herbert_at_13thfloor.at)
Date: Sun 02 May 2004 - 23:39:36 BST
On Sun, May 02, 2004 at 11:59:39PM +0200, Christopher Michl wrote:
> Hi,
>
> I did not found any answer to my question on this list before, so here
> is my problem:
> I'm using several vservers with privat (192.168.x.x) IP's bind to eth1.
> My provider gave me five official IP's for my interface eth0.
> So I'm using SNAT ($IPT -A POSTROUTING -t nat -s 192.168.x.x -d 0/0 -j
> SNAT --to <official IP>) and DNAT ($IPT -A PREROUTING -t nat -p tcp -s
> 0/0 -d <official IP> --dport 80 -j DNAT --to-destination 192.168.x.x:80).
> That runs complete well, except that I can't access my webserver out of
> my vserver (lynx www.example.de in my vserver don't work, where
> example.de is a virtual Host in my Apache). Worldwide I have no problem
> to access my website. If I enter the private IP to Hostname mapping in
> my /etc/hosts I have also no problems (192.168.x.x example.de).
-A POSTROUTING -t nat -s 192.168.x.x -d 0/0 -j SNAT --to <official IP>
says: rewrite any packet leaving the box, originating from
an ip in the range 192.168.x.x to something coming from
<official IP> (you actually need --to-source IIRC)
-A PREROUTING -t nat -p tcp -s 0/0 -d <official IP> --dport 80
-j DNAT --to-destination 192.168.x.x:80.
says: redirect any packet arriving at the <official IP>:80
to some local hosts:80
so if you are connecting from a local ip to another one,
none of those rules are consulted ...
> Is this a routing or iptables Problem? It looks like the packets does
> not go through the prerouting table.
well it is expected, you should read the following
documents, especially the routing part ...
http://list.linux-vserver.org/archive/vserver/msg06615.html
http://list.linux-vserver.org/archive/vserver/msg06631.html
http://list.linux-vserver.org/archive/vserver/msg06667.html
> I am grateful for each assistance.
HTH,
Herbert
> Best regards
> Christopher Michl
>
>
>
>
>
> _______________________________________________
> Vserver mailing list
> Vserver_at_list.linux-vserver.org
> http://list.linux-vserver.org/mailman/listinfo/vserver
_______________________________________________
Vserver mailing list
Vserver_at_list.linux-vserver.org
http://list.linux-vserver.org/mailman/listinfo/vserver