assigning alias ip address

Jason Opperisano opie at
Fri Sep 10 14:45:51 CEST 2004

On Fri, 2004-09-10 at 08:23, John Black wrote:
> > routing.  the "one-arm" router scenario can be made to work, as long as
> > you understand the traffic flow and the routing quirks that can arise. 
> > the $25,000 question is:  what is the default gateway of and
> > .12?
> the gateway for these ip address is

which is an IP address on what device, and where is this device located
in the logical flow of traffic?

> > is there a particular reason why your netfilter box can't have 2 NICs in
> > it, with the servers placed behind it?
> > 
> the netfilter box has 4 NICs
> eth0 (outside world)
> eth1 ( 
> eth2 ( 
> eth3 ( 

was the 10.10.10.x stuff in your original post an analogy for (outside

since my dentistry skills are a bit rusty, i'll answer you question in
the generic case:

when you DNAT a request packet (TCP SYN, for example), you need to
ensure that the reply packet (TCP SYN-ACK) also "goes through" the
device performing the DNAT.  otherwise--the threeway handshake will
never complete.  the fancy word for this is asymmetric routing. and it
looks something like:

1)  client sends SYN from to

2)  DNAT device receives SYN packet from destined for
and DNATs it to

3) receives SYN packet from and replies with SYN-ACK
directly through it's default gateway (which is not the DNAT device, nor
is DNAT device upstream from this gateway)

4)  client ( receives SYN-ACK from and discards it,
as client never sent a SYN to

the cheap and dirty solution is to have DNAT device perform an
additional SNAT on the request from to make it appear to come
from ${DNAT device's IP address}; thus ensuring that will
send it's SYN-ACK back through DNAT device.  the downside is that it
makes all your traffic appear to come from one IP address--which has it
obvious logging/tracking disadvantages.

the preferred solution is to perform the DNAT at such a point in the
network topology as to avoid an asymmetric routing situation.

not sure if this helps, hurts, or annoys.


Jason Opperisano <opie at>

More information about the netfilter mailing list