How to DNAT to different local IP based on what public IP was accessed with Shorewall?

Question

My server has several public IPs, and is running a bunch of virtual machines with private IP adresses.

As an example, I want to map ports 80, 443 and 8080 on 232.21.23.23 (public) to 192.168.122.12 (private). I have tried a couple of different NAT mappings, but none of them seem to work:

# This doesn't work.
DNAT           net              loc:192.168.122.12  tcp  80,443,8080  -           232.21.23.23

# Neither does this.
DNAT           $FW              loc:192.168.122.12  tcp  80,443,8080  -           232.21.23.23

# Nor this.
DNAT           net:232.21.23.23 loc:192.168.122.12  tcp  80,443,8080

# I have no idea what I'm doing.
DNAT           $FW:232.21.23.23 loc:192.168.122.12  tcp  80,443,8080

Can anyone point me in the right direction?

Answer 1

Your first rule is correct:

DNAT    net loc:192.168.122.12  tcp 80,443,8080 -   232.21.23.23

So the problem must lie elsewhere. You can see the underlying iptables rules created with this:

iptables -t nat -nvL net_dnat

NATed packets still need to traverse the FORWARD chain and be accepted. Try adding the following rule to accept traffic to the VMs on these ports:

ACCEPT  net loc:192.168.122.12  tcp 80,443,8080

Answer 2

As an additional comment to the previous answers, make sure the order in which you place rules.

Example:

Let's say you configured your rules like this:

DNAT net loc:172.17.20.25 tcp  80  0.0.0.0
DNAT net loc:172.17.20.47 tcp  80  200.x.y.z

If you wanna get to 172.17.20.47 on port 80, you will always end up in 172.17.20.25 because the destination address is the default 0.0.0.0.

So if you wanna get to 172.17.20.47 trough public ip address 200.x.y.z, you should modify the order of the rules:

DNAT net loc:172.17.20.47 tcp  80  200.x.y.z
DNAT net loc:172.17.20.25 tcp  80  0.0.0.0

Or modifiy the default address of the first rule.

I hope it helps!