Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I overlap IP masquerading (PAT/Overload) with destination NAT using iptables on the internal IP space?

What I am trying to have is a private network, ie where some public IPs are mapped to various address inside of it. However, if there is a connection that originates from within, regardless if it has a DNAT public ip or not, it will get overloaded to a specific public IP.

share|improve this question
up vote 1 down vote accepted

I hope I'm understanding your question, too. Your response to Luke in the comments to baumgart's answer caused me to second-guess my understanding your requirements, but I'm going to post this anyway.

What baumgart is telling you to do in his answer will work, but his last paragraph where he talks about "...will likely cause problems with client-server apps..." isn't correct. He's forgetting that Netfilter's NAT implementation is stateful. That stateful nature of the NAT engine in Netfilter is your friend here.

When the conversation between an Internet host and one of your public IPs gets DNAT'ed to a private IP address Netfilter won't "MASQUERADE" the response packets coming from the private IP back to the Internet host. That's not to say the response packets aren't NAT'ed, but they're not "MASQUERADED". Rather, Netfilter implicity "does the right thing" and SNAT's the response packets from the private IP back to the public IP address to which the Internet host initiated the conversation. It's really very slick.

Meanwhile, for conversations originating from the private IP address to the Internet (not in response to incoming requests from the Internet) the "MASQUERADE" rule will apply.

Basically, Netfilter does what you want "out of the box". I took some time and mocked this up on a test setup just to be sure, and, so long as I understand your requirements properly, it's doing exactly what you're looking for.

(Sorry about not being able to answer earlier in the day-- I was busy with some things earlier today and couldn't, ya' know, play Server Fault as much as I like to.)

share|improve this answer
Ya I thought it wasn't working with just the two rules but I had some funky routing going on so I misidentified the problem. – Kyle Brandt Jul 23 '10 at 12:18

I hope I'm understanding your question here...

Sounds like you want to have a standard NAT from your internal network outbound to a single IP on the outside - yes? That part is accomplished with this:


As for the mapping public IPs to internal IPs, this should work for each one:

iptables -t nat -A PREROUTING -d $EXTERNAL_IP -j DNAT --to $INTERNAL_IP

That would give you a one-way map for the external to internal IPs. The traffic coming in from one public IP will be natted to the the internal box, and then it will respond but the response will be natted through the default external IP. It may not be the same one. That will likely cause problems with client-server apps.

share|improve this answer
No, he only wants connections ORIGINATING on the internal to be SNAT'ed through a specific public IP. – Luke has no name Jul 22 '10 at 18:17
Yes this is close but I want what Luke says. The MASQUERADE takes effect only when the packet hasn't been translated on its way in ... – Kyle Brandt Jul 22 '10 at 18:21
I did this on Cisco with route maps. I had a NOT_FOR_NAT route map where I made entries for all my one-to-one mappings so they would be excluded. – Kyle Brandt Jul 22 '10 at 18:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.