NAT Loopback Routers

From OpenSimulator

Revision as of 13:21, 18 January 2011 by Justincc (Talk | contribs)

Jump to: navigation, search
Languages Languages: 

En.png English   De.png Deutsch   Fr.png Français

Imbox content.png

This article or section contains incomplete information.
Please help us by completing the content on this page.


Contents

INTRODUCTION

What is NAT Loopback and why is it needed to host a public Opensimulator Region?

Currently (as at August 2010), a hosted region on a home connection with a broadband router needs, what is known as NAT Loopback functionality.

Many DSL routers/modems prevent loopback connections as a security feature. This means that a machine on your local network (e.g. behind your DSL router/modem) cannot connect to a forward facing IP address (such as 199.149.252.44) of a machine that it also on your local network. Connecting to the local IP address (such as 192.168.2.40) of that same machine works fine.

This is an issue since each region has to be specify an IP address for the client to connect. This is the ExternalHostName parameter in a regions config file (e.g. bin/Regions/Regions.ini). In the absence of NAT loopback, if a forward facing IP address is specified (such as 199.149.252.44) then external clients will be able to connect to the region but clients on your local network will not. If the internal address were put in ExternalHostName instead (e.g. 192.168.2.40) then viewers on the local network will be able to connect but viewers from an external network would not.

This page shows a list of routers supporting NAT Loopback. Please add both known working and non-working routers to the list.

Working Routers

D-Link

D-Link DGL-4500 series of routers have the largest available nat table of any router on the market.  These routers range from 70$-180$ USD depending on where you live and purchase from.

When considering a purchase, consider performance against cost. Upper end ADSL 2+ routers can add several Mbs to your modems sync speed.

Wireless Routers - Access Point Only

These routers are Access Point devices, and contain no ADSL modem and hence need a separate adsl modem operating in Bridge mode.

Routers With ADSL modem No items to list currently

Note: The DGL-4100 & DGL-4300 have been discontinued, and the replacement model is the DIL-825 and DIL-855 - Loopback status unknown on these later models. The DGL-4300 may be available second hand.

Draytek

  • Draytek Vigor 2710n [1] does NAT loopback out of the box and seems to be generally an all-round great router.
  • Draytek Vigor 120 [2] does NAT loopback out of the box and has some nice features. NOTE that if it's using PPPoA (common in UK and New Zealand) there is a bug that stops Opensim (and Secondlife) ping packets from working so you disconnect after 3 minutes. You need to upgrade to firmware 3.2.4.3 (or higher).

Netgear

Linksys/Cisco

Note: The WAG54G v2 NZ/Australia version has a faster processor, more memory and larger NAT table, and works with OS out of the box. Other market versions may not.

3Com

  • 3CRWDR100A-72
  • 3CRWDR101A-75

Zyxel

  • If you are using a ZyXEL DSL router/modem from Embarq, please read this configuration guide. This will show you how to reconfigure your DSL router/modem to fix this problem.

Other routers & Hardware

KNOWN non-functional for OpenSim:


REFERENCE LINKS:

More Information Related to Routers and Solutions @: osgrid.org/forums/viewtopic.php

Linux specific solutions

SETTING UP A LINUX COMPUTER TO ACT AS A ROUTER

For Linux based Netfilter (iptables) routers, you want to set up the NAT table with some extra entries The following script is something to get you started, you'll need to fix up the variables at the top to match your system and network. 
#!/bin/bash
#
# vvvvv - Fix these! - vvvvv
IPTABLES=/usr/sbin/iptables
LAN_NETWORK=192.168.0.0/24
SERVER_IP=192.168.0.2
INTERNET_IP=100.100.100.100
REMOTING_PORT=8895
REGION_PORT=9000
# ^^^^^ - Fix these! - ^^^^^
 
# First, the Destination NAT, anything going to the external address on our ports, we redirect to the server
# Note, if you have a double NAT running and this router doesn't actually have the internet IP address, you'll
# need another set of PREROUTING-DNAT lines with the --destination (-d) set to the internet facing private address
$IPTABLES -t nat -I PREROUTING -d $INTERNET_IP -p tcp --dport $REMOTING_PORT --jump DNAT --to-destination $SERVER_IP
$IPTABLES -t nat -I PREROUTING -d $INTERNET_IP -p udp --dport $REGION_PORT --jump DNAT --to-destination $SERVER_IP
$IPTABLES -t nat -I PREROUTING -d $INTERNET_IP -p tcp --dport $REGION_PORT --jump DNAT --to-destination $SERVER_IP
 
# Second, the Source NAT, we need this so that returning packets to our LAN clients go back through the router first,
# otherwise, the server will try to talk directly to the client and the client will reject them
$IPTABLES -t nat -I POSTROUTING -s $LAN_NETWORK -d $SERVER_IP -p tcp --dport $REMOTING_PORT --jump SNAT --to-source $INTERNET_IP
$IPTABLES -t nat -I POSTROUTING -s $LAN_NETWORK -d $SERVER_IP -p udp --dport $REGION_PORT --jump SNAT --to-source $INTERNET_IP
$IPTABLES -t nat -I POSTROUTING -s $LAN_NETWORK -d $SERVER_IP -p tcp --dport $REGION_PORT --jump SNAT --to-source $INTERNET_IP

--Hell Fire

DNS solution

It's possible to host your own DNS-server, so you can prevent some of the dns-naming problems mentioned before. If http://example.org resolves to the external ip, and that loopback connection is prevented by your router, you could point your resolv.conf to a local nameserver like: 

nameserver 192.168.2.2

Now you need bind/named installed in order to handle the dns-requests. You can find a bind example configfile here.

openWRT Routers:

If you use openWRT firmware on your router, check here: OpenWRT NATLoopback

Windows XP Work Around:

Please see this -> http://vio.blpcomputers.info/loopbacknat.php

Retrieved from "http://opensimulator.org/index.php?title=NAT_Loopback_Routers&oldid=20953"
Personal tools
General
About This Wiki