Linux ARP Proxy and NAT

Sometimes we build an experimental network (192.168.1.0/24) within an existing network (10.10.10.0/24), as shown in the network structure.

Suppose we cannot control (modify) the system configuration except for the D host in a network, but can control the host in Network B completely.

At this point, Server D actually assumes the role of a route (it has two network cards in two networks, a, and within a, b)

So first turn on the kernel routing forwarding function on it, modify the following configuration in the/etc/sysctl.conf

Net.ipv4.ip_forward = 1

Post-Save app View

# Sysctl-pnet.ipv4.ip_forward = 1

It is also necessary to ensure that the routing table on server D is configured correctly, and here we assume that the 10.10.10.103 on D is eth0, and 192.168.1.1 is on the same interface as Eth1

Finally, the default gateway for the host in Network B is set to the 192.168.1.1 address of server D, and the preparation is complete. The following can be used in different ways to make network B and network a host to achieve a different degree of interconnection.

SNAT

If you want all hosts in the B network to have one-way access to resources within a network, you can make a NAT (SNAT) on server D:

Iptables-t nat-a postrouting-o Eth0-j Masquerade

This method is the most commonly used NAT, the host in the internal network B can proactively initiate requests to access the resources in the external network A, to achieve internal and external network host communication, but outside the network a host cannot actively establish a connection with the intranet host. The host in Intranet B does not have an independent IP within the a network.

If you only want to allow a host in a B network to access a network, you can qualify the source IP, specifically refer to the Iptables manual:

Iptables-t nat-a postrouting-s 192.168.100.100-o eth0-j Masquerade

SNAT + DNAT + arp proxy = floating IP

If we want to assign an IP such as 10.10.10.104 to server e within Network B, the host within network A can directly access the host E

At this point we can first make a snat on server D:

Iptables-t nat-a postrouting-o eth0-s 192.168.1.100-j SNAT--to-source 10.10.10.104

When the network a network receives a packet from server E, the IP you see is 10.10.10.104, and its response will be sent back to this address

Then we do a dnat on server D:

Iptables-t nat-a prerouting-i eth0-d 10.10.10.104-j DNAT--to-destination 192.168.1.100

This way, when server D receives a packet with the destination IP of 10.10.10.104, it modifies the IP of the server E (192.168.1.100) that the destination IP is in Network B, and naturally follows the routing rules on Server d that the package eth1 out of the interface, goes through Switch B, arrives at server E.

Now there is a problem, we can not modify the host configuration within network A, how to make IP 10.10.10.104 packets to server D (because host D own IP is 10.10.10.103). If we plug in another NIC from Server D, let's set its address to 10.10.10.104, but we don't need to do that. We add a secondary address to the Eth0 interface on host D to

IP addr Add 10.10.10.104/24 dev eth0

In this way, the host in Network A will be able to respond by using the ARP protocol to query the MAC address of 10.10.10.104, and send a virtual MAC address. So sent to the 10.10.10.104 package will reach the host D, in the above-mentioned Dnat steps, on both sides can be interoperable.

Service Port Mappings SNAT + DNAT

Floating IP scenarios require a network A's IP, and host E is completely exposed, and can sometimes expose services within network B through port mapping to external network A, such as mapping 2222 ports on server D to port 22 on server E. In this way, the host access 10.10.10.103:2222 in Network A is actually accessing the host 192.168.100:22 in Network B.