Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a STUN service running on the same machine that is the gateway for the LAN, I would like the results from the STUN service be the same for both internal and external machines. Currently since the masquerading is done in the postrouting rule when the packets leave the gateway the STUN server will just see the LAN IP/port instead of the natted ip/port.

eth1 (lan): 10.0.0.1/32
eth0 (wan): 1.2.3.4/31
iptables -A POSTROUTING -t nat -o eth0 -j MASQUERADE 
iptables -A INPUT -p udp -d 1.2.3.4/31 --dport 3701 -j ACCEPT

When a LAN machine with IP 10.0.0.2 contacts the STUN service at 1.2.3.4 the packets get through but the STUN service see that the packet gets sent from 10.0.0.2.

How can I get the NAT translation to occur before the packet arrive to the STUN service and that the response back from the STUN service won't be from 10.0.0.1 but rather the 1.2.3.4 used when contacting the service?

share|improve this question

1 Answer 1

Look at the image. Packets gets translated by MASQUERADE when they are to be routed. But your destionation host it the same host as router. So packet won't go through nat-POSTROUTING chain and won't be translated. They will go through filter table instead

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.