Debian etch: how to correct wrong iptables/NAT

Question

I have a problem on a Debian Etch machine... For dark and stormy reasons its ip on eth0 is weird but we have to keep it like this...

Its ifconfig:

eth0      Link encap:Ethernet            
          inet addr:128.0.0.250    Mask:255.255.0.0 

eth1      Link encap:Ethernet  
          inet addr:192.168.1.250  Mask:255.255.255.0

With the command:

iptables –t nat –L POSTROUTING

I get:

target                prot      opt       source              destination
ACCEPT                0         --        128.0.0.2           anywhere
MASQUERADE            0         --        !192.168.1.0/24    anywhere

The second rule, if I've understood correctly, does a nat of all the traffic different from 192.168.1.0/24. In other words all the packets headed to a lan for whom I have a routing rule are sent from the Debian Etch's machine ip, losing their real sender.

I would like this machine not to NAT the traffic not passing through it. I'll try to be clearer... It should NAT only traffic coming from 128.0.0.250 (its ip) and going out from 192.168.1.250.

I am learning linux lately and this is a little too much :/ Can anybody help (maybe giving directions to backup the config so I can be safe in case of total mess)?

Thanks a lot!

Answer 1

You can back up the current iptables configuration with:

iptables-save >iptables-20101117

That will save the currently running rules which can be restored with:

iptables-restore <iptables-20101117

The "iptables -L" command doesn't list all the information about the rules, including things like Interface restrictions, so we may not be seeing the full picture here. I usually look at the output of "iptables-save" to make sure I'm seeing the full rule information.

As far as the rule goes, there should be no traffic coming from it's internal 128 IP address and going out the 192 interface. Traffic leaving the 192 interface should bind to the 192 interface IP address. So if you don't want the MASQUERADE rule you can remove it.

I typically change rules by editing the file and using iptables-restore on the full rule-set. iptables-restore is atomic, so the full set of new rules get applied at once.

Answer 2

Also, you can get a slightly more verbose out put with:

iptables –t nat –vnL POSTROUTING

Which will show you the input/output interfaces for the rule. (the -n part tells it not to resolve port numbers/IP addresses, which I find easier to look at, but that's more of a taste thing...)

As for the rules, with NAT, I try to stick with interface-based rules, rather than matching IP addresses, as it's more robust in environments where the external IP might change.

The most common outbound NAT rule there would be:

iptables -t nat -I POSTROUTING -s <LAN netblock> -o eth0 -j MASQUERADE

Which makes all traffic from the LAN, bound for the wider world (if that's what eth0 is) will have eth0's IP. (Edited with correction)

However, if I read your request correctly, it sounds like you don't want any NAT at all. Remember that traffic coming directly from the machine itself will always have a source address of the interface it goes out on. You don't need any NAT rules for that.

A useful diagram here: http://www.shorewall.net/NetfilterOverview.html showing the flow of a packet through the various tables.