Need help with multiple WAN IPs routed to internal IPs

Post new topic   Reply to topic    DD-WRT Forum Index -> Broadcom SoC based Hardware
Goto page Previous  1, 2, 3  Next
Author Message
jungwirth-media
Donator


Joined: 25 Jul 2006
Posts: 51

PostPosted: Tue Sep 23, 2008 2:20    Post subject: Reply with quote
thank you for your answer !

for the ports:
let's say, on a computer i didn't have a really usefull firewall but wanna have an external IP for outgoing connections. Now with the rules the same IP also would be open for incoming. I would like to prevent that and just open ports as needed for this ip's .

_________________
Firmware: DD-WRT v24-sp2 (07/21/09) std-special
---------------------------
5 x Linksys WRT54GL - V1.1
Zyxel P-660H-D1
Netgear Switch 16 Port
FRITZ!Box Fon WLAN 7170
Linksys SPA-2102
Pirelli PRGAV4202N
Mac-User
Sponsor
joksi
DD-WRT Guru


Joined: 16 Jan 2007
Posts: 1240

PostPosted: Tue Sep 23, 2008 2:26    Post subject: Reply with quote
I have done some additions to my post just right after you posted :)

Now, only one IP and one port is open from the outside, this is what the prerouting does.

The postruting nly translates traffic out, so from outside no one can initiate traffic on these public IPs in the post routing roules, they will be stopped at the router cause it dont know what to do with it.

If you wanted that, you would have to add a similar prerouting statement for all IPs.
jungwirth-media
Donator


Joined: 25 Jul 2006
Posts: 51

PostPosted: Tue Sep 23, 2008 2:38    Post subject: Reply with quote
great thank you !
that is what i needed exactly !
you made my day Smile thanks again.

_________________
Firmware: DD-WRT v24-sp2 (07/21/09) std-special
---------------------------
5 x Linksys WRT54GL - V1.1
Zyxel P-660H-D1
Netgear Switch 16 Port
FRITZ!Box Fon WLAN 7170
Linksys SPA-2102
Pirelli PRGAV4202N
Mac-User
joksi
DD-WRT Guru


Joined: 16 Jan 2007
Posts: 1240

PostPosted: Tue Sep 23, 2008 2:45    Post subject: Reply with quote
Your welcme Smile
jungwirth-media
Donator


Joined: 25 Jul 2006
Posts: 51

PostPosted: Tue Sep 23, 2008 12:22    Post subject: Reply with quote
Hi @ all

Some feedback from me...

inserted into "startup":

Code:

# Assign the wanted IPs to WAN interface on router (vlan1)
ifconfig vlan1:1 195.xx.xx.219 netmask 255.255.255.248 broadcast 195.xx.xx.223
ifconfig vlan1:2 195.xx.xx.220 netmask 255.255.255.248 broadcast 195.xx.xx.223
ifconfig vlan1:3 195.xx.xx.221 netmask 255.255.255.248 broadcast 195.xx.xx.223
ifconfig vlan1:4 195.xx.xx.222 netmask 255.255.255.248 broadcast 195.xx.xx.223


inserted into "firewall":
Code:

# Tell DD-WRT to map, and route all tcp 80 traffic o the following IP to the corresponding LAN IP
iptables -t nat -I PREROUTING -i vlan1 -d 195.xx.xx.219 -j DNAT --to-destination 192.168.1.19
iptables -I FORWARD -p tcp -i vlan1 -d 192.168.1.19 --dport 80 -j ACCEPT

# Tell DD-WRT to translate outgoing connectins frm the followin LAN IPs to corresponding WAN IPs
iptables -t nat -I POSTROUTING -o vlan1 -s 192.168.1.19 -j SNAT --to-source 195.xx.xx.219
iptables -t nat -I POSTROUTING -o vlan1 -s 192.168.1.20 -j SNAT --to-source 195.xx.xx.220
iptables -t nat -I POSTROUTING -o vlan1 -s 192.168.1.21 -j SNAT --to-source 195.xx.xx.221
iptables -t nat -I POSTROUTING -o vlan1 -s 192.168.1.22 -j SNAT --to-source 195.xx.xx.222

# Transalte the rest to routers public IP
iptables -t nat -I POSTROUTING -o vlan1 -s 192.168.1.0/24 -j SNAT --to-source 195.xx.xx.218


The IP of the linksys-Router: 195.xx.xx.218
gateway: 195.xx.xx.217

Following problem right now: Using the IP from the router work at all - but using an other external IP didn't work.
I get always the main IP.


Edit: Incoming Connection for port 80 of 195.xx.xx.219 works fine.

So maybe just forgot something ?

_________________
Firmware: DD-WRT v24-sp2 (07/21/09) std-special
---------------------------
5 x Linksys WRT54GL - V1.1
Zyxel P-660H-D1
Netgear Switch 16 Port
FRITZ!Box Fon WLAN 7170
Linksys SPA-2102
Pirelli PRGAV4202N
Mac-User
jungwirth-media
Donator


Joined: 25 Jul 2006
Posts: 51

PostPosted: Tue Sep 23, 2008 13:20    Post subject: Reply with quote
got it to work !

Code:
iptables -t nat -I POSTROUTING -o vlan1 -s 192.168.1.0/24 -j SNAT --to-source 195.xx.xx.218

just to be inserted BEFORE the other rules for the different IP's.

I extended the using of the ip's too.
Use PPTP server to connect to linksys with a predefined internal-ip so i am able to change my outgoing ip just on time without edit some rules on wrt54gl.


great - now after 7 months it works :D

(for future search some tags: xpirio , ADSL, Austria, Multi IP, multiple IP)

_________________
Firmware: DD-WRT v24-sp2 (07/21/09) std-special
---------------------------
5 x Linksys WRT54GL - V1.1
Zyxel P-660H-D1
Netgear Switch 16 Port
FRITZ!Box Fon WLAN 7170
Linksys SPA-2102
Pirelli PRGAV4202N
Mac-User
joksi
DD-WRT Guru


Joined: 16 Jan 2007
Posts: 1240

PostPosted: Tue Sep 23, 2008 14:19    Post subject: Reply with quote
Yes, it have to be before those other rules. Better is to add numbers after "-I POSTROUTING X", ie 1, 2, 3.
fwenigho
DD-WRT Novice


Joined: 02 Nov 2008
Posts: 1

PostPosted: Sun Nov 02, 2008 15:18    Post subject: Similar problem, shure it's me! Reply with quote
Hello friends of dd-wrt.
I read this threads, and I find out, that's the perfect configuration for me. I've 4 unused public IP's in 93.83.xxx.208/29 network. I've implemented all the things which were described on this sides. But after trying this configuration, I find out that under the next "free" IP, allways the Routerkonfigurationpage Linksys on 93.83.xxx.210 appears, what the hell, webgui is configured for port 8083, and not 80? So I tried configured another free one (eg. 93.83.xxx.212 (addon to 93.83.xxx.211)). But still the same, I'm frustrated, what can I do to solve this problem?
My Config:
93.83.xxx.208/29 Base
93.83.xxx.209/29 Cisco 800 in routing modus
93.83.xxx.210/29 Linksys WGT54GL v1.1/ddwrt v24-sp1/192.168.0.0/24
93.83.xxx.211/29 the first point of interest - configured to lanIP 192.168.0.251, and therefor configured a netgear router with this Wan adress, and dhcp config, networking LanIP 192.168.1.0/24.
Inside the 192.168.0.0/24 everything works fine, but from outside, accessing by public IP, I allways getting the Linksys.
BTW: Can someone help? Thanks in advance!
Franz
jungwirth-media
Donator


Joined: 25 Jul 2006
Posts: 51

PostPosted: Fri Jan 23, 2009 23:20    Post subject: Reply with quote
hi

you have the same configuration as i have - read my post and it should work Smile

_________________
Firmware: DD-WRT v24-sp2 (07/21/09) std-special
---------------------------
5 x Linksys WRT54GL - V1.1
Zyxel P-660H-D1
Netgear Switch 16 Port
FRITZ!Box Fon WLAN 7170
Linksys SPA-2102
Pirelli PRGAV4202N
Mac-User
Patrice Tremblay
DD-WRT Novice


Joined: 09 Apr 2009
Posts: 16

PostPosted: Thu Apr 09, 2009 6:57    Post subject: Reply with quote
Why the SNAT command dont work here? (the router dont recognise it)..

It was a good beginning...out of that important point


Thanks to help!
phuzi0n
DD-WRT Guru


Joined: 10 Oct 2006
Posts: 10141

PostPosted: Thu Apr 09, 2009 7:00    Post subject: Reply with quote
Patrice Tremblay wrote:
Why the SNAT command dont work here? (the router dont recognise it)..

It was a good beginning...out of that important point


Thanks to help!

What build are you running?
Patrice Tremblay
DD-WRT Novice


Joined: 09 Apr 2009
Posts: 16

PostPosted: Thu Apr 09, 2009 7:03    Post subject: Reply with quote
DD-WRT v24-sp1 std build 10011



Ps: by the way, i was unable to continu at this point of configuration but now when i enter my public ip in browser, i'm getting in the router panel.
phuzi0n
DD-WRT Guru


Joined: 10 Oct 2006
Posts: 10141

PostPosted: Thu Apr 09, 2009 7:36    Post subject: Reply with quote
Patrice Tremblay wrote:
DD-WRT v24-sp1 (07/27/0Cool std

Ps: by the way, i was unable to continu at this point of configuration and now when i enter my public ip in browser, i'm getting in the router panel.


Start out by reading the peacock thread stickied in this forum and pay attention to note 3 because SP1 is terrible.

Traffic from your lan doesn't actually go through the wan port so it doesn't get blocked even though it's going to the wan ip.

Also what do you mean by the router doesn't recognize the command, does it give an error specifically?
Patrice Tremblay
DD-WRT Novice


Joined: 09 Apr 2009
Posts: 16

PostPosted: Thu Apr 09, 2009 7:49    Post subject: Reply with quote
yes, it's telling me unknow command snat or something like that but it mean that it dont know that command.

Is the beta sp2 version may be better?
phuzi0n
DD-WRT Guru


Joined: 10 Oct 2006
Posts: 10141

PostPosted: Thu Apr 09, 2009 8:11    Post subject: Reply with quote
The better question is, how bad does a release have to be to have the forum community advise against using it.

Your build apparently is missing the SNAT target or maybe it was compiled as a module but that's a pretty strong indication your build is bad.
Goto page Previous  1, 2, 3  Next Display posts from previous:    Page 2 of 3
Post new topic   Reply to topic    DD-WRT Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum