Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have to connect two LANs: LAN1: 10.10.0.0/16 and LAN2: 192.168.0.0/16. I can't do simple routing, because 192.168.0.0/16 net is prohibited in LAN1, so I am thinking of using Full cone nat (1:1) to translate 192.168.x.y/16 to 10.11.x.y/16. Each translation is done by this rules:

iptables -t nat -A PREROUTING -d 10.11.0.0/16 -j DNAT --to-destination 192.168.0.0/16
iptables -t nat -A POSTROUTING -s 192.168.0.0/16 -j SNAT --to-source 10.11.0.0/16

But I will have to enter 254*254*2 rules, what will, I think, result in enormous performance degradation. So, is there a way to write such one-to-one translation with minimum number of rules?

share|improve this question
    
Why can't you just route between the two networks??? –  Khb Feb 4 '10 at 14:29
    
BECAUSE(second line): I can't do simple routing, because 192.168.0.0/16 net is prohibited in LAN1 –  TiFFolk Feb 4 '10 at 15:24

3 Answers 3

Like the first answer said, use -j NETMAP:

# iptables -t nat -A PREROUTING -d 10.11.0.0/16 -j NETMAP --to 192.168.0.0/16
# iptables -t nat -A POSTROUTING -s 192.168.0.0/16 -j NETMAP --to 10.11.0.0/16

It's probably a good idea to add -d 10.10.0.0/16 in the POSTROUTING row as well.

share|improve this answer

I am not sure if it is present in all kernels, but what you may be looking for is the NETMAP target.

From the iptables man page

NETMAP
 This target allows you to statically map a whole network of 
 addresses onto another network of addresses. It can only be 
 used from rules in the nat table. 

 --to address[/mask]
     Network address to map to. The resulting address will be 
     constructed in the following way: All 'one' bits in the 
     mask are filled in from the new 'address'. All bits that 
     are zero in the mask are filled in from the original 
     address. 
share|improve this answer

You can do this with a small shell script

#!/bin/bash
for (( i=0 ; $i<256 ; i=$i+1 )) ; do
  for (( j=0 ; $j<256 ; j=$j+1 )) ; do
    iptables -t nat -A PREROUTING -d 10.11.$i.$j/16 -j DNAT --to-destination 192.168.$i.$j/16
    iptables -t nat -A POSTROUTING -s 192.168.$i.$j/16 -j SNAT --to-source 10.11.$i.$j/16
  done
done

But I think thereis an error. I think it should be /32 and not /16.

share|improve this answer
    
/32, I have already done that but I want to find a more beautiful way, than 254*254*2 rules –  TiFFolk Feb 4 '10 at 21:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.