If you are interested in Linux routing using iptables with VirtualBox, please keep reading.
Check below diagram before start.
First download Sun VirtualBOX CentOS 5.7 base image from http://sourceforge.net/projects/virtualboximage/files/CentOS/5.7/CentOS-5.7-i386.7z/download
Username is root and password is reverse.
Extract 7zip file into folder. Double click the "CentOS 5.7" virtualbox definition file which will load the image file in Sun VirtualBox OS.
Before loading the OS, change network adapter type from "NAT" to "Internal" to separate from Host to Guest OSs.
Here are the configuration of three network cards from CentOS1
Configure eth0 as Internal Network and it will connect to CentOS2's eth0.
cat /etc/sysconfig/network-scripts/ifcfg-eth0
DEVICE=eth0
BOOTPROTO=static
HWADDR=08:00:27:AE:36:99
ONBOOT=yes
HOSTNAME=centos57
IPADDR=192.168.10.1
NETMASK=255.255.255.0
---------------
Configure eth1 as "NAT" as this will be connect to Host OS and then to Internet.
cat /etc/sysconfig/network-scripts/ifcfg-eth1
DEVICE=eth1
BOOTPROTO=dhcp
HWADDR=08:00:27:42:79:DF
ONBOOT=yes
HOSTNAME=centos57
--------------------
Configure eth2 as "Host Only" as this will be connected to Host OS for testing DNAT.
cat /etc/sysconfig/network-scripts/ifcfg-eth2
DEVICE=eth2
BOOTPROTO=dhcp
HWADDR=08:00:27:73:EE:17
ONBOOT=yes
HOSTNAME=centos57
---------------------------------------------
Routing table of CentOS1 will be as below.
# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.20.0 192.168.10.2 255.255.255.0 UG 0 0 0 eth0
10.0.3.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1
192.168.10.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
192.168.56.0 0.0.0.0 255.255.255.0 U 0 0 0 eth2
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth2
0.0.0.0 10.0.3.2 0.0.0.0 UG 0 0 0 eth1
--------------
The default route is 10.0.3.2 which is the NAT (network adaptor)'s default gateway. The IP address of eth1 (to Internet) is getting IP from VirtualBox's DHCP server and it's 10.0.3.15 as below.
eth0 Link encap:Ethernet HWaddr 08:00:27:AE:36:99
inet addr:192.168.10.1 Bcast:192.168.10.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:519 errors:0 dropped:0 overruns:0 frame:0
TX packets:394 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:61152 (59.7 KiB) TX bytes:58765 (57.3 KiB)
eth1 Link encap:Ethernet HWaddr 08:00:27:42:79:DF
inet addr:10.0.3.15 Bcast:10.0.3.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:178 errors:0 dropped:0 overruns:0 frame:0
TX packets:198 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:46726 (45.6 KiB) TX bytes:15718 (15.3 KiB)
eth2 Link encap:Ethernet HWaddr 08:00:27:73:EE:17
inet addr:192.168.56.101 Bcast:192.168.56.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:405 errors:0 dropped:0 overruns:0 frame:0
TX packets:291 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:41142 (40.1 KiB) TX bytes:42926 (41.9 KiB)
------------------------------
Create iptables file in /etc/sysconfig directory as follow for NATing
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
COMMIT
*nat
-A POSTROUTING -s 192.168.20.0/24 -j SNAT -o eth1 --to-source 10.0.3.15
-A POSTROUTING -s 192.168.10.0/24 -j SNAT -o eth1 --to-source 10.0.3.15
COMMIT
---------------------------
Two tables; filter and nat have created as above. Filtering table allow all from inbound, outbound and forwarding.
For NAT table, add two POSTROUTING to do NATing 192.168.10.x and 192.168.20.x using destination address of eth1 (10.0.3.15)
-----------------------------
Load next CentOS2 in VirtualBox with the following configuration.
cat /etc/sysconfig/network-scripts/ifcfg-eth0
# Intel Corporation 82540EM Gigabit Ethernet Controller
DEVICE=eth0
BOOTPROTO=static
HWADDR=08:00:27:64:2F:C0
ONBOOT=yes
HOSTNAME=centos57-min2
IPADDR=192.168.20.1
NETMASK=255.255.255.0
GATEWAY=192.168.10.1
--------------------
cat /etc/sysconfig/network-scripts/ifcfg-eth1
# Intel Corporation 82540EM Gigabit Ethernet Controller
DEVICE=eth1
BOOTPROTO=static
HWADDR=08:00:27:37:B1:CF
ONBOOT=yes
HOSTNAME=centos57-min2
IPADDR=192.168.10.2
NETMASK=255.255.255.0
GATEWAY=192.168.10.1
-----------------------
Enable IP forwarding as below. IP forwarding need to able to route packet from CentOS3 to CentOS1 to Internet through CentOS2.
Edit /etc/sysctl.conf and change net.ipv4.ip_forward=0 to 1.
# Controls IP packet forwarding
net.ipv4.ip_forward = 1
--------------
Routing table of CentOS2 will be looks like below.
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.20.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
192.168.10.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth1
0.0.0.0 192.168.10.1 0.0.0.0 UG 0 0 0 eth1
------------------------------
Create another CentOS3 as follow.
eth0 Link encap:Ethernet HWaddr 08:00:27:88:81:74
inet addr:192.168.20.2 Bcast:192.168.20.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:1655 errors:0 dropped:0 overruns:0 frame:0
TX packets:2028 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:194793 (190.2 KiB) TX bytes:217249 (212.1 KiB)
eth1 Link encap:Ethernet HWaddr 08:00:27:59:A8:F0
inet addr:192.168.30.1 Bcast:192.168.30.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:19 errors:0 dropped:0 overruns:0 frame:0
TX packets:5 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1140 (1.1 KiB) TX bytes:210 (210.0 b)
---------------
cat /etc/sysconfig/network-scripts/ifcfg-eth0
# Intel Corporation 82540EM Gigabit Ethernet Controller
DEVICE=eth0
BOOTPROTO=static
HWADDR=08:00:27:88:81:74
ONBOOT=yes
HOSTNAME=centos57-min2
IPADDR=192.168.20.2
NETMASK=255.255.255.0
GATEWAY=192.168.20.1
-----------------------------
cat /etc/sysconfig/network-scripts/ifcfg-eth1
# Intel Corporation 82540EM Gigabit Ethernet Controller
DEVICE=eth1
BOOTPROTO=static
HWADDR=08:00:27:59:A8:F0
ONBOOT=yes
HOSTNAME=centos57-min2
IPADDR=192.168.30.1
NETMASK=255.255.255.0
--------------------------
Routing table will be looks like below.
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.20.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
192.168.30.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth1
0.0.0.0 192.168.20.1 0.0.0.0 UG 0 0 0 eth0
--------------
Ping to 192.168.10.2 and 192.168.10.1. Ping to 192.168.10.2 will get replies but will failed in 192.168.10.1 as CentOS1 doesn't know about 192.168.20.x network yet.
This can be done by adding the permanent routing in CentOS1 as follow.
To reach to 192.168.20.x network from CentOS1, create a file called route-eth0 and add the below line.
192.168.20.0/24 via 192.168.10.2
Save and restart the "network" service.
Try to ping from CentOS3 to 192.168.10.1. Ping will success and able to reach Internet as well.
Tracerouteing to Internet will get through as below.
traceroute www.google.com
traceroute to www.google.com (74.125.235.48), 30 hops max, 40 byte packets
1 192.168.20.1 (192.168.20.1) 1.429 ms 1.218 ms 0.922 ms
2 192.168.10.1 (192.168.10.1) 2.296 ms 2.220 ms 2.163 ms
-------------------
In CentOS1, try to replace the following two NAT rules (comment out) with the new one as below.
-A POSTROUTING -s 192.168.20.0/24 -j SNAT -o eth1 --to-source 10.0.3.15
-A POSTROUTING -s 192.168.10.0/24 -j SNAT -o eth1 --to-source 10.0.3.15
Replace with;
-A POSTROUTING -o eth1 -j MASQUERADE
Save and restart iptables "service iptables restart". Check whether CentOS3 still able to ping Internet or not. MASQUERADE will allow all internal private IP address by NATing and get through Internet. But, it's not recommend to use if there are two or more Internet facing interfaces as it will use only first one. For more info, please read in http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_:_Ch03_:_Linux_Networking
---------------------
To test DNAT, we have added third network interface in CentOS1 called eth2 (192.168.56.x).
The point is if your PC (host) browse to the IP address (192.168.56.101) which is the IP address of eth2, it will redirect to the IP address of CentOS3 which will be loading as web server.
To do this, install http server in CentOS3 as follow.
yum install httpd
After all completed, change the configuration as follow.
nano -w /etc/httpd/conf/httpd.conf
Change the value Listen localhost:80 to
Listen 192.168.20.2:80
Restart the httpd service.
Add the following rule under NAT table of CentOS1's iptable.
-A PREROUTING -d 192.168.56.101 -j DNAT -i eth2 --to-destination 192.168.20.2
Restart the iptables in CentOS1.
Try to browse http://192.168.56.101 from your PC's browser and you will see the website loaded in CentOS3.
No comments:
Post a Comment