Brad Smith wrote:
On Thu, 16 Sep 2004 08:41:34 -0400, Christopher K. JohnsonI have two ideas.
<ckjohnson@xxxxxxx> wrote:
Brad Smith wrote:
With iptables forwarded packets would not hit the INPUT or OUTPUTThe packets hit PREROUTING and FORWARD, but not INPUT or OUTPUT, as expected. All chains on the gateway ACCEPT by default The firewall on the client and vnc server is down
chains. That was only true of ipchains.
I should have phrased that better. I meant that I didn't expect the packets to hit INPUT or OUTPUT and they didn't. =:)
Given Kenneth's observation about interfaces I would double-check the
address in the nat rule, and I would verify that the interface
connecting to the vnc server is correctly addressed and masked to
include that address. My guess is that one of those is wrong and the gw
is trying to deliver the nat'd packets via its default gateway.
Well, here's an interesting development. It turns out that everything works fine if the client is on the other side of the gateway from the server. It's only connections between two internal machines that break and I think I just figured out why.
Iptables is actually doing its job perfectly: when the client sends a request to the server it is forwarded to the vnc server. The vnc server recieves the vnc client's SYN packet and responds with a SYN/ACK. But the client is expecting a response from the gateway, not the vnc server and so responds with an RST instead of an ACK. Repeat ad infinitum.
So basically, for this to work we'd need to do both DNAT for the
redirection and SNAT to keep the response from confusing the client.
As far as I know there's no way to do that with a single rule but,
just out of curiosity, I'd love to hear if anyone has ideas.
Since both systems are on the inside (on the same network) they should not involve the gateway in the process at all.
Based on your description of what is occurring the client is attempting to reach the public address of the vnc server, not the private address. You need to modify your private dns server entry, or if you do not have one, well that should really be fixed by creating one. Having a split dns configuration is one of the things that makes public/private access to servers much smoother. And it allows you to make hosts on the private network aware of all the other private servers that are not known publicly.
Chris
-- ----------------------------------------------------------- "Spend less! Do more! Go Open Source..." -- Dirigo.net Chris Johnson, RHCE #807000448202021
