[AusNOG] Redirecting a TCP port both directions

[Nick Pratley]

Geordie,

You could always look apache proxypass, if it's just web traffic.

SSL certificates would need to sit on the intermediate system, though.

Sent from my iPhone

On 8 Apr 2014, at 12:17 pm, Geordie Guy <elomis at gmail.com> wrote:

Yeah OK let me clarify, you didn't miss something, I did.

172.31.1.2 may be inside RFC1918, but I don't think the AWS systems have a
copy of the RFC as text and use it, there's another set of rules it uses
(that may be a subset of RFC1918 - maybe 10.0.0.0/8) that are the only ones
it'll allow for local routing and down tunnels to on-premise environments.
 I think *glaring angrlly at the console*, actually it'll only allow
172.16.0.0/16 down tunnels or locally and sends 172.31.0.0/16 to the
Internet.

Either way, I need to redirect a socket.


On Tue, Apr 8, 2014 at 12:11 PM, Mark Foster <blakjak at blakjak.net> wrote:

>  Did I miss something?
>
> Private IPv4 address spaces
>
> The Internet Engineering Task Force<https://en.wikipedia.org/wiki/Internet_Engineering_Task_Force>(IETF) has directed the Internet
> Assigned Numbers Authority<https://en.wikipedia.org/wiki/Internet_Assigned_Numbers_Authority>(IANA) to reserve the following IPv4 address ranges for private networks,
> as published in RFC 1918 <https://tools.ietf.org/html/rfc1918>:[1]<https://en.wikipedia.org/wiki/Private_network#cite_note-1>
>   RFC1918 name IP address range number of addresses largest CIDR<https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing>block (subnet mask) host
> id size mask bits *classful
> <https://en.wikipedia.org/wiki/Classful_network>* description[Note 1]<https://en.wikipedia.org/wiki/Private_network#cite_note-3>  24-bit
> block 10.0.0.0 - 10.255.255.255 16,777,216 10.0.0.0/8 (255.0.0.0) 24 bits 8
> bits single class A network<https://en.wikipedia.org/wiki/Class_A_network>  20-bit
> block 172.16.0.0 - 172.31.255.255 1,048,576 172.16.0.0/12 (255.240.0.0) 20
> bits 12 bits 16 contiguous class B networks  16-bit block 192.168.0.0 -
> 192.168.255.255 65,536 192.168.0.0/16 (255.255.0.0) 16 bits 16 bits 256
> contiguous class C networks
> .... pretty sure that 172.31.1.x IP's fit nicely within that 20-bit block
> that encompasses everything from 172.16.0.0 to 172.31.255.255...
>
> So where you've said 'non-RFC1918' you infact mean 'RFC1918', right? So
> you're having problems with AWS routing traffic for these RFC1918 addresses
> to the Internet when that's not what you want?
>
> Mark.
>
>
> On 8/04/2014 2:07 p.m., Geordie Guy wrote:
>
> Hi Folks,
>
>  Working with a B2B partner who has exposed non-RFC1918 addresses
> 172.31.1.2 and 172.31.1.3 through a VPN tunnel to our environment, and this
> works fine for hitting a web service down the tunnel from our local
> networks.  We have a development footprint in AWS that is shanking at this,
> because an overlying abstraction layer for how AWS S3 instances route means
> that if it sees a non-RFC1918 range it sends it out to the Internet
> regardless of any host or other level routes that are specified.  I can set
> route add 172.31.1.0/24 via a gateway or for that matter the loopback
> until I go blue in the face and the server will merrily continue to try and
> find the IP on the Internet.
>
>  What I need to do, other than not allow design decisions that involve
> non RFC-1918 addresses for private networks, is redirect a TCP port (443)
> from an IP that I *CAN* hit inside our network, to the 172.31.1.0 range
> down the tunnel, so that 1654287.r.msn.com stops scratching his head at
> the traffic trying to hit him from AWS.
>
>  What do I do to accomplish this?  Netcat?  And before anyone says NAT,
> there's already been enough bad decisions made here.
>
>  Regards,
>
>  Geordie
>
>
> _______________________________________________
> AusNOG mailing listAusNOG at lists.ausnog.nethttp://lists.ausnog.net/mailman/listinfo/ausnog
>
>
>
_______________________________________________
AusNOG mailing list
AusNOG at lists.ausnog.net
http://lists.ausnog.net/mailman/listinfo/ausnog
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.ausnog.net/pipermail/ausnog/attachments/20140408/a3c6bd65/attachment.html>