What is the proper way to handle DNAT when traffic leaves a different interface than it arrived on? When this happens it seems the reply doesn't have the source address replaced automatically as it would if it were going out the same interface it arrived on.
Edit -- SNAT not working out for me:
Chain PREROUTING (policy ACCEPT 386 packets, 23372 bytes) pkts bytes target prot opt in out source destination 0 0 DNAT all -- * * 0.0.0.0/0 184.108.40.206 to:10.7.0.5 Chain POSTROUTING (policy ACCEPT 288 packets, 18672 bytes) pkts bytes target prot opt in out source destination 0 0 SNAT all -- * eth0 10.7.0.5 0.0.0.0/0 to:220.127.116.11 0 0 SNAT all -- * eth3 10.7.0.5 0.0.0.0/0 to:18.104.22.168 8 550 MASQUERADE all -- * eth0 172.16.14.0/30 0.0.0.0/0 0 0 MASQUERADE all -- * eth0 10.7.0.0/24 0.0.0.0/0 Chain OUTPUT (policy ACCEPT 23 packets, 1572 bytes) pkts bytes target prot opt in out source destination
So in the above both routers have the same tables and same interface layout. eth0 on both routers are Internet connections and eth1 on each router connects to the same LAN (10.7.0/24). eth3 connects the two routers to each other.
What is happening is am pinging the 22.214.171.124 address from a location on the Internet. The replies go in Router B via eth0 and out eth1 with the destination nat working fine. The replies are entering eth1 on Router A and exiting the Internet via eth0 on router A. However, the source address is not being overwritten and the replies make it back to the device sending the pings with 10.7.0.5 address*.
*Yes, they actually make it across 20 hops with a private source IP and don't get squashed anywhere -- kind of amazing).
Even More Edit:
Okay, apparently SNAT (at least it seems from the iptables manual) only matches if it is stateful. So I need stateless nat. This can be done with iproute2, but according to http://linux-ip.net/html/nat-dnat.html#ex-nat-dnat-full it can also be simulated by using --to-destination with SNAT in iptables. However, my ubuntu 10.04 just says unknown option