Re: stateless 1:1 NAT
Herbert Xu wrote: Florin Andrei [EMAIL PROTECTED] wrote: OK, if I download 2.6.24-rc1, will it have this feature already? Yes. OK, I want to test this feature with 2.6.24-rc2. I compiled iproute2-2.6.23 with your patch applied. The problem is, I have no experience with tc (and very little experience with iproute2 in general). Can you give me an example on how to setup 1:1 NAT for one system? Let's say, the firewall has the addresses 10.123.0.10 (eth0 outside) and 10.123.1.10 (eth1 inside), the server behind it is 10.123.1.253 and I want to map the server's address to 10.123.0.253 on the outside interface. What are the parameters for tc to setup 1:1 NAT like that? -- Florin Andrei http://florin.myip.org/ - To unsubscribe from this list: send the line unsubscribe netdev in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: stateless 1:1 NAT
Patrick McHardy wrote: Florin Andrei wrote: OpenBSD 4.1 as a firewall fails even worse in this test case (it freezes instantly). OpenBSD 4.2 works fine under the UDP flood, as if nothing happened. And Linux 2.6.23? :) Same as 2.6.18, actually maybe a little bit worse than .18: the current download does not even complete, and of course a new one doesn't start. I may test 2.6.24 and stateless 1:1 NAT and we'll see what happens. I've been told that stateless 1:1 NAT is already in the .24_rc1 so I may test that. -- Florin Andrei http://florin.myip.org/ - To unsubscribe from this list: send the line unsubscribe netdev in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: stateless 1:1 NAT
Herbert Xu wrote: Florin Andrei [EMAIL PROTECTED] wrote: I've heard that stateless 1:1 NAT will be possible with the upcoming 2.6.24 kernel. I'd like to test that feature, but I'm not sure when it will actually be included. Will it be present in the release candidates for 2.6.24? I just need a somewhat stable kernel tree to play with. Yes it will be. OK, if I download 2.6.24-rc1, will it have this feature already? If not, when is it supposed to be included in the main kernel? Thanks, -- Florin Andrei http://florin.myip.org/ - To unsubscribe from this list: send the line unsubscribe netdev in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: stateless 1:1 NAT
Herbert Xu wrote: Florin Andrei [EMAIL PROTECTED] wrote: I've heard that stateless 1:1 NAT will be possible with the upcoming 2.6.24 kernel. I'd like to test that feature, but I'm not sure when it will actually be included. Will it be present in the release candidates for 2.6.24? I just need a somewhat stable kernel tree to play with. Yes it will be. So here's the thing I'm trying to solve. Gigabit network. Dual homed firewall, doing 1:1 NAT for a bunch of web servers. Some protocols are allowed inbound to the servers (the external, NATed addresses). Firewall is running CentOS 5 (kernel 2.6.18) I run pktgen on a test machine to generate a whole lot of small UDP packets with random source addresses. I send the packets to the firewall, to one of the 1:1 NATed addresses, to a port that's blocked by the firewall. Meanwhile, I'm downloading a 2GB file from a web server through the firewall, in a while [ 1 ] loop, to monitor the functioning of the firewall. When I start the UDP flood, the current download is able to finish up, but a new one won't start. The firewall has one of the cores pegged at 100% CPU usage, with a lot of interrupts being generated all the time. I assume there's something related to conntrack, that's why I want to test stateless rules. I assume the firewall has much less work to do if it's doing everything stateless, at least at the NAT level. Is it going to be possible to combine stateless 1:1 NAT with stateful filtering? By the way: OpenBSD 4.1 as a firewall fails even worse in this test case (it freezes instantly). OpenBSD 4.2 works fine under the UDP flood, as if nothing happened. -- Florin Andrei http://florin.myip.org/ - To unsubscribe from this list: send the line unsubscribe netdev in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html
Re: stateless 1:1 NAT
Patrick McHardy wrote: And Linux 2.6.23? :) Alright, I get it. :-) Building kernel 2.6.23.1 as we speak. -- Florin Andrei http://florin.myip.org/ - To unsubscribe from this list: send the line unsubscribe netdev in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html
stateless 1:1 NAT
I've heard that stateless 1:1 NAT will be possible with the upcoming 2.6.24 kernel. I'd like to test that feature, but I'm not sure when it will actually be included. Will it be present in the release candidates for 2.6.24? I just need a somewhat stable kernel tree to play with. -- Florin Andrei http://florin.myip.org/ - To unsubscribe from this list: send the line unsubscribe netdev in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html
