IPTables Masquerading Issue

[johncongdon]

ARGH, My ascii art got messed up

In words, A connects to another more expensive pipe. So my client wants to connect to the server through B on a cheaper internet connection.

Here is the tcpdump from A.

root@PSWEBNODE1 [~]# tcpdump -i eth1 icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 96 bytes
19:10:15.712422 IP 10.0.73.11 > MachineC: ICMP echo request, id 13396, seq 54, length 64
19:10:16.712385 IP 10.0.73.11 > MachineC: ICMP echo request, id 13396, seq 55, length 64
19:10:17.712322 IP 10.0.73.11 > MachineC: ICMP echo request, id 13396, seq 56, length 64
19:10:18.712270 IP 10.0.73.11 > MachineC: ICMP echo request, id 13396, seq 57, length 64

[Mark_NL]

ahhhh, so:

A -> C goes over line B
C -> A goed over line A

That could mess things up. Also the tcpdump shows you the replies are not reaching A.
They do reach B, but B want to send them over another line to A ?

Though i think i understand your ASCII art now ;-)

- A and B are both connected to the same internal private network.
- A is connected to external net 1
- B is connected to external net 2
- C is connected somewhere completely different (on the other side of the world f.e.)

Show me:
- iptables-save (server A and B)
- route -n (server A and B)

[johncongdon]

I was just informed that the physical machine was put in and worked right away. Turns out there was an ACL in the virtual environment that I had zero control over.

I'm not crazy... Yipee!

Thanks for trying.

[Mark_NL]

Turns out there was an ACL in the virtual environment that I had zero control over.

aaaaaaaaargl .. i think i just pulled out a pluck of hair from my head

[pamellayao]

I have done that as well. Both give me the same results. The SNAT was a last attempt and something that I read was "more secure" than just masquerade.

[pamellayao]

The SNAT was a last attempt and something that I read was "more secure" than just masquerade.