View source

This article explains how to configure <code>iptables</code> in order to seamlessly forward [[SNMP]] traffic from the TMG's management interface to the adapter and the other way around. This allows an external equipment to request SNMP information from the adapter by querying the TMG management interface's IP address. 

In order to achieve most of the instructions in this article, you will need to login as <code>root</code> on your TMG (or an account with superuser privileges). 

== Requirements  ==

The release installed on the target system must be one of the following: 

*2.3.36 RC1 or later 2.3.x releases 
*2.4.28 RC1 or later 2.4.x releases 
*2.5.10 RC1 or later 2.5.x releases

The target unit is a TMG800 or TMG3200. See [[TMG7800 SNMP support]] for TMG5800/TMG7800 Your license must allow the use of SNMP on the adapter. 

== Collect information about your TMG  ==

In order to setup <code>iptables</code> correctly, the following information is needed: 

#The IP address of the TMG's management interface (can be obtained using <code>ifconfig eth0</code>). If you are using DHCP, it is not needed. 
#The IP addresses of both the Linux host and the adapter on the internal interface: 
##The host IP address can be obtained using <code>ifconfig eth1</code>. 
##The adapter ''host'' IP address can be obtained by opening a shell to the adapter and using <code>print_net</code>.

A typical TMG setup will have the following configuration. This configuration will be used in the following instructions; replace the corresponding settings with your own. 

*Management interface IP: <code>DHCP</code> 
*Internal Linux IP: <code>172.31.1.2</code> 
*Internal adapter IP: <code>172.31.1.1</code>

== Installing net-snmp-utils (optional)  ==

To know if <code>net-snmp-utils</code> is already installed, invoke <code>snmpget</code> on the command line of your TMG Linux host. The <code>snmpget</code> tool is used on the TMG to verify if the SNMP feature is available and working from the adapter. 

#If your management interface has direct Internet access, install <code>net-snmp-utils</code>: <code></code>
<pre><code>yum install net-snmp-utils</code>
</pre>
If your TMG is not connected to the Internet and TBLinux is used, the <code>net-snmp-libs-5.4.2.1-2.tb1.ppc.rpm</code> and <code>net-snmp-utils-5.4.2.1-2.tb1.ppc.rpm</code> packages must be downloaded from the [http://download.distribution.telcobridges.com/TBLinux/updates/1/os/ the TBLinux distribution packages site], uploaded to the TMG and installed using <code></code><br> 
<pre>yum localinstall net-snmp-libs-5.4.2.1-2.tb1.ppc.rpm net-snmp-utils-5.4.2.1-2.tb1.ppc.rpm</pre> 
&nbsp;&nbsp;&nbsp;&nbsp; 2. Test SNMP: <code></code><br> 
<pre>snmpget -d -v 1 -c public 172.31.1.1 SNMPv2-MIB::sysUpTime.0</pre> 
If this command does not work, check the Web portal to see if the unit has the SNMP license 
<pre>Status -&gt; Adapters -&gt; Licensed Features -&gt; search for SNMP
</pre> 
If it does not appear, contact TelcoBridges support group<br> 

== Enabling IP forwarding  ==

To enable IP forwarding permanently on the TMG, edit the <code>/etc/sysctl.conf</code> file and set the <code>net.ipv4.ip_forward</code> element to <code>1</code>. For example: 

 [root@TB006009 ~]# vi /etc/sysctl.conf  
 
 ...
 # Controls IP packet forwarding
  net.ipv4.ip_forward = 1

'''NOTE''': A reboot is required to activate this setting. It is possible to enable it immediately by setting the contents of <code>/proc/sys/net/ipv4/ip_forward</code> to <code>1</code>. For example: <code></code> 
<pre>echo 1 &gt; /proc/sys/net/ipv4/ip_forward</pre>

== Installing iptables  ==

To know if iptables is installed on your system, you may just invoke it on the command line (type <code>iptables</code>). If it is not installed: 

*If the management interface has an Internet connection, use
<pre>yum install iptables
</pre> 
*If no Internet connection is available and TBLinux is used, the <code>iptables-1.4.1.1-1.tb1.ppc.rpm</code> package must be downloaded from [http://download.distribution.telcobridges.com/TBLinux/updates/1/os/ the TBLinux distribution packages site], uploaded to the TMG and installed using <code></code>
<pre>yum localinstall iptables-1.4.1.1-1.tb1.ppc.rpm
</pre> 
After installing <code>iptables</code>, you may see that no rules are set yet by using: 
<pre>iptables -v -L</pre> 
== Configuring iptables  ==

Input the following lines at the command line: 

  iptables -t nat -A PREROUTING -p udp -i eth0 --dport 161 -j DNAT --to-destination 172.31.1.1
  iptables -t nat -A POSTROUTING -p udp -o eth1 --dport 161 -j MASQUERADE

'''OR''' input the following lines if you are not using DHCP and want to use SNAT instead of MASQUERADE: 

  iptables -t nat -A PREROUTING -p udp -i eth0 --dport 161 -j DNAT --to-destination 172.31.1.1
  iptables -t nat -A POSTROUTING -p udp -o eth1 --dport 161 -j SNAT --to-source 172.31.1.2

Consult the added rules by using <code></code> 
<pre>iptables -t nat -n -L</pre> 
Permanently save the rules by using 
<pre>service iptables save</pre> 
If everything worked, SNMP requests should be answered from the TMG's management interface. 

== References  ==

*[http://en.wikipedia.org/wiki/Iptables Wikipedia's iptables article] 
*[http://www.netfilter.org/ Official iptables website] 
*<code>man iptables</code>