|
selective masquerading
I am running Linux 2.6.20 on i686 architecture.
I want to be able to masquerade different hosts on my LAN to different external interfaces. Specifically, I want one specific host to masquerade through a vpn tunnel while the other hosts simply masquerade over the regular ISP interface. I only use one host to access the VPN, and its connection is unreliable (using microsoft ras) and I was hoping to be able to set up my linux server to handle maintaining the vpn connection (using its real ip as opposed to masquerading for the windows host).
eth0 = internal = 192.168.0.1
I tried setting up eth0:0 to be 192.168.1.1 and putting the said host in the 192.168.1.0/24 network, which works. So I'd be happy if I can masq 192.168.1.0/24 over the VPN and 192.168.0.0/24 over eth1's internet IP.
I tried this:
#iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -o eth1 -j MASQUERADE
#iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o ppp0 -j MASQUERADE
thinking I could maybe change the masquerade destination interface based on source IP, but traffic from 192.168.1.13 is still masquerading over the eth1 IP rather than ppp0. I'm stumped here. I really don't care to have the virtual interface; it just seemed like it would make things easier since the 192.168.0.0/24 network has several hosts that don't use the VPN all of which I want masqueraded via eth1.
As a last resort I suppose I could connect a second linux box to the VPN and have it masquerade the VPN and be the gateway for the VPN client(s), but that linux machine would itself be masqueraded by the main server, which opens it to having the same problems I am already having trying to get the masqueraded windows client to connect properly.
iptables is so amazingly powerful I'm sure what I want must be possible, but I am a bit of a novice. Any assistance will be greatly appreciated.
Thanks.
|