<div dir="ltr">Friendly ping for feedback or alternative suggestions to fix the problem<div class="gmail_extra"><br></div><div class="gmail_extra">Thx,</div><div class="gmail_extra">Hans<br><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><pre style="white-space:pre-wrap;color:rgb(0,0,0)">Hi,
The problem occurs in the following scenario where two hosts A and B are in
use on the lan and connected to a router which is doing masquerade on the
wan link.
Host A has a private IP@ (eg <a href="http://192.168.1.10/24" target="_blank">192.168.1.10/24</a>) while host B has a public IP@
(eg <a href="http://172.18.16.240/24" target="_blank">172.18.16.240/24</a>); the router has a public IP@ on the wan in the same
subnet as host B (eg <a href="http://172.18.16.245/24" target="_blank">172.18.16.245/24</a>).
A redirect rule is defined on the router to forward tcp service 8080 to
host A port 80 and translates into following iptables nat rules :
Chain delegate_prerouting (1 references)
pkts bytes target prot opt in out source
destination
2 68 prerouting_rule all -- * * <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a>
<a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> /* user chain for prerouting */
1 32 zone_lan_prerouting all -- br-lan * <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a>
<a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a>
0 0 zone_wan_prerouting all -- pppoe-wan * <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a>
<a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a>
chain zone_wan_prerouting (1 references)
pkts bytes target prot opt in out source
destination
0 0 prerouting_wan_rule all -- * * <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a>
<a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> /* user chain for prerouting */
0 0 DNAT tcp -- * * <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a>
<a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> tcp spt:8080 /* @redirect[0] */ to:<a href="http://192.168.1.10:80" target="_blank">192.168.1.10:80</a>
TCP traffic on pppoe-wan interface with as destination port 172.18.16.245
will be redirected to 192.168.1.10 as expected but if host B runs a similar
tcp service on port 8080 it will be unreachable as traffic directed to
172.18.16.240 will also be re-directed to 192.168.1.10.
The patch tries to fix this issue by using the wan IP address in the
zone_wan_prerouting lookup; in this case traffic destined for 172.18.16.240
will not be redirected.
Chain delegate_prerouting (1 references)
pkts bytes target prot opt in out source
destination
1 87 prerouting_rule all -- * * <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a>
<a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> /* user chain for prerouting */
1 87 zone_lan_prerouting all -- br-lan * <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a>
<a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a>
0 0 zone_wan_prerouting all -- pppoe-wan * <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a>
172.18.16.245
Chain zone_wan_prerouting (1 references)
pkts bytes target prot opt in out source
destination
0 0 prerouting_wan_rule all -- * * <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a>
<a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> /* user chain for prerouting */
0 0 DNAT tcp -- * * <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a>
<a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> tcp spt:8080 /* @redirect[0] */ to:<a href="http://192.168.1.10:80" target="_blank">192.168.1.10:80</a>
Output of fw3 print diff before/after the patch
< iptables -t nat -D delegate_prerouting -i pppoe-wan -j zone_wan_prerouting
< iptables -t nat -A delegate_prerouting -i pppoe-wan -j zone_wan_prerouting
---
><i> iptables -t nat -D delegate_prerouting -i pppoe-wan -d
</i><a href="http://172.18.16.245/255.255.255.255" target="_blank">172.18.16.245/255.255.255.255</a> -j zone_wan_prerouting
><i> iptables -t nat -A delegate_prerouting -i pppoe-wan -d
</i><a href="http://172.18.16.245/255.255.255.255" target="_blank">172.18.16.245/255.255.255.255</a> -j zone_wan_prerouting
Bye,
Hans
On Thu, Oct 1, 2015 at 10:05 PM, Jo-Philipp Wich <<a href="https://lists.openwrt.org/cgi-bin/mailman/listinfo/openwrt-devel" target="_blank">jow at openwrt.org</a>> wrote:
><i> Hi,
</i>><i>
</i>><i> wouldn't this break port forwards to hosts not being within the range of
</i>><i> the on-link lan subnet?
</i>><i>
</i>><i> I also read the patch description three times and still am not sure what
</i>><i> that change attempts to achive.
</i>><i>
</i>><i> Can you further explain the problem please and provide a before/after
</i>><i> "fw3 print" diff so that I better understand your proposed solution?
</i>
><i> ~ Jow
</i>><i>
</i>></pre></div>
</blockquote></div><br></div></div>