<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
</head>
<body bgcolor="#ffffff" text="#000000">
I'm trying to route packets to many different addresses via DNAT. The
target addresses<br>
could have any address and are behind a device we install at the remote.<br>
<br>
Here is an example setup:<br>
<br>
<small><b><tt>+--------------+ +--------------+<br>
| Server |----| PC |<br>
| 10.0.5.1 |eth0| 10.0.5.50 |<br>
+--------------+ +--------------+<br>
| Tunnel (ppp)<br>
+--------------+<br>
| Device |<br>
| 10.0.5.2 |<br>
+--------------+<br>
| eth0 172.30.100.0/24<br>
+--------------+<br>
| PBX |<br>
| 172.30.100.10| <br>
+--------------+<br>
<br>
<br>
</tt></b></small>On the server, I have this route 172.30.100.10/32
-> 10.0.5.2<br>
<br>
On the device, I'm using MASQ on eth0.<br>
The device does not see me at 10.0.5.1, It<br>
will see me as the device.<br>
<br>
The way I understand DNAT is that if I want to "assign"<br>
10.0.5.3 to the PBX then I need to do this on the server<br>
<br>
<b><small><tt>ifconfig eth0:1 10.0.5.3<br>
iptables -t nat -A PREROUTING -i eth0 -d 10.0.5.3 -j DNAT
--to-destination 172.30.100.10</tt></small></b><br>
<br>
Am I right?<br>
<br>
The only problem with this is that I may have 100s of our devices
connected<br>
via tunnels to remote networks so I could have eth0:1 ... eth0:512. <br>
<br>
I was hoping there was a way to not use the aliases and do this strictly<br>
via routing.<br>
<br>
If the eth0 on the server was 10.0.0.0/16 Then I could use 10.0.7.0/24
for<br>
all the remote devices.<br>
<b><small><tt><br>
iptables -t nat -A PREROUTING -i eth0 -d 10.0.7.1 -j DNAT
--to-destination 172.30.100.10</tt></small></b><br>
<br>
The benefit here is that if I use OpenVPN on the server to connect<br>
via laptops(s) running Winders and push 10.0.0.0/16, then<br>
they can have access to 100s of devices. Will that work?<br>
Do I really need a corresponding SNAT entry? The PBX<br>
is really behind an embedded Linux device. Should it, instead<br>
of the server, be the one where the DNAT rules are applied? <br>
<br>
Chris<br>
<br>
<br>
<br>
<pre class="moz-signature" cols="72">--
Chris Fowler
OutPost Sentinel, LLC
Support @ <a class="moz-txt-link-abbreviated" href="mailto:SIP/support@pbx.opsdc.com">SIP/support@pbx.opsdc.com</a>
or 678-804-8193
Email Support @ <a class="moz-txt-link-abbreviated" href="mailto:support@outpostsentinel.com">support@outpostsentinel.com</a>
</pre>
</body>
</html>