Rerouting remote users to VPN channel

Hi,

I have one specific routing situation that I still can't
handle, so I am 
asking for some help.

I have Linux server, one eth interface and 2 DSL links. One
DSL is VPN 
link to another site's Web Intranet application. VPN link
itself is 
realised via DSL line and CISCO router. Local users can work
with that 
application. Another DSL is Internet gateway for local
users, and 
incomming channel for accessing server from outside (there
is Siemens 
DSL router).

I want to provide that external remote users can connect to
that server 
from Internet and use that Intranet application via another
DSL and VPN 
channel.

Route table:
# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric
Ref    Use 
Iface
192.168.30.9     192.168.93.65    255.255.255.255 UGH   0   
  0 
0 eth0
192.168.93.64    0.0.0.0         255.255.255.192 U     0    
 0        0 
eth0
127.0.0.0       0.0.0.0         255.0.0.0       U     0     
0        0 lo
0.0.0.0         192.168.93.122   0.0.0.0         UG    0    
 0        0 
eth0

...93.64/26 is LAN,
...93.65 is VPN gateway to Intranet Web server on another
site,
...93.122 is Internet gateway,
...30.9 is Intranet Web server with The Application on
remote site.

Local users can go to Internet and on Intranet app on remote
site, and 
that works fine. I need rules that Internet users comming
from public IP 
using http://mysite.dyndns.
biz:myport through ...93.122 can go to 
http://192.168.30.9:80. I
succesfully set forwarding on DSL router so 
incomming packets comes to server on port 'myport' (I
can't 
reroute/rewrite packets on DSL router itself).

I tried with one PREROUTING rule, but I can't rewrite both
source and 
destination address, so obviusly I need two rules?

Thank anyone for any help,
GI

Hi Ivan,

Yes, you need SNAT and DNAT rules.  Something like this
ought to work
(note: this should be on your Internet Gateway's Firewall,
otherwise
you have to forward port 80 traffic from the Gateway to your
linux
server.  You are running linux on your internet gateway,
right?  ;)

iptables -t mangle -A PREROUTING -d <yourPublicIP> -p
tcp --dport 80
-j MARK --set-mark 80
iptables -t nat -A PREROUTING -m mark --mark 80  -j DNAT
--to 192.168.30.9
iptables -A FORWARD -m mark --mark 80 -j ACCEPT
iptables -t nat -A POSTROUTING -m mark --mark 80 -j SNAT
--to
<firewallPrivateIP>

assumes the internet gateway has a route to 192.168.30.9

If you have to run this on a different linux machine,
replace
<yourPublicIP> with <firewallPrivateIP>

If this doesn't work or doesn't make sense, be sure to
post a network
diagram in your email.

Good Luck,

Matt

On 4/24/06, Ivan Gustin <ivan.gustinpu.t-com.hr> wrote:
> Hi,
>
> I have one specific routing situation that I still
can't handle, so I am
> asking for some help.
>
> I have Linux server, one eth interface and 2 DSL links.
One DSL is VPN
> link to another site's Web Intranet application. VPN
link itself is
> realised via DSL line and CISCO router. Local users can
work with that
> application. Another DSL is Internet gateway for local
users, and
> incomming channel for accessing server from outside
(there is Siemens
> DSL router).
>
> I want to provide that external remote users can
connect to that server
> from Internet and use that Intranet application via
another DSL and VPN
> channel.
>
> Route table:
> # route -n
> Kernel IP routing table
> Destination     Gateway         Genmask         Flags
Metric Ref    Use
> Iface
> 192.168.30.9     192.168.93.65    255.255.255.255 UGH  
0      0
> 0 eth0
> 192.168.93.64    0.0.0.0         255.255.255.192 U    
0      0        0
> eth0
> 127.0.0.0       0.0.0.0         255.0.0.0       U     0
     0        0 lo
> 0.0.0.0         192.168.93.122   0.0.0.0         UG   
0      0        0
> eth0
>
> ...93.64/26 is LAN,
> ...93.65 is VPN gateway to Intranet Web server on
another site,
> ...93.122 is Internet gateway,
> ...30.9 is Intranet Web server with The Application on
remote site.
>
> Local users can go to Internet and on Intranet app on
remote site, and
> that works fine. I need rules that Internet users
comming from public IP
> using http://mysite.dyndns.
biz:myport through ...93.122 can go to
> http://192.168.30.9:80. I
succesfully set forwarding on DSL router so
> incomming packets comes to server on port 'myport' (I
can't
> reroute/rewrite packets on DSL router itself).
>
> I tried with one PREROUTING rule, but I can't rewrite
both source and
> destination address, so obviusly I need two rules?
>
> Thank anyone for any help,
> GI
>
>

Matt Barclay:
> Yes, you need SNAT and DNAT rules.  Something like this
ought to work

Thank you, Matt, for answering.

> iptables -t mangle -A PREROUTING -d
<yourPublicIP> -p tcp --dport 80
> -j MARK --set-mark 80
> iptables -t nat -A PREROUTING -m mark --mark 80  -j
DNAT --to 192.168.30.9
> iptables -A FORWARD -m mark --mark 80 -j ACCEPT
> iptables -t nat -A POSTROUTING -m mark --mark 80 -j
SNAT --to
> <firewallPrivateIP>

Yes, I set up something like this few hours ago, and it
worked. But, 
unfortunately, Intranet Web application uses absolute
private IP 
addresses, so that can't work. Application starts, but when
user clicks 
on some option connection hangs trying to open http://192.168.30.9/....

:-( I can't change third-party Web app.

I don't see any other solution but setting up VPN so users
have private 
routeable IP addresses.

Thanks anyway.

GI