Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a linux machine running ubuntu server with 2NICS (WAN and LAN). I want the LAN side machines to use the linux box as a gateway to get on the internet (WAN side). The only problem is that the LAN side machines will have static IP's and cannot be configured for DHCP. I have to work arround the settings they have. I have written a small program which runs on the server, listens to ARP requests and gets all client trafic and NATs them to the WAN side. The clients now can ping google irrespective of their static IP addresses.

My code does NAT, based on MAC addresses i.e. A client's packets from XX:YY will be sent out using as source address. Another client with ZZ:ZZ will have packets with source address on the WAN side interface. The purpose of all of this is to have sort of a zero config internet access for captive portal users.

My problem is that i am having trouble getting TCP/HTTP to work through my NAT. The GET request does not get a reply from the WAN side so i am stuck and thinking of alternatives!

Question time: 1. Can this be done using netfilter and IP tables? instead of writhing my own NAT code. 2. Are there any open source user space NAT programs that i could take and modify? 3. Can i modify the current netfilter code? will this be a huge task?

My tools: libpcap, gcc, wireshark, ubuntu server 10.10

I am new to linux network programming, any sujesions would be appreciated.



share|improve this question

migrated from Apr 4 '11 at 11:08

This question came from our site for professional and enthusiast programmers.

I don't see why using a static addressing would be a problem. Netfilter do native NAT and is easy to build with iptables.

If "eth0" represents your LAN-side interface on the server, and eth1 the WAN-side, running "iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE" (the minimum required for a NAT) should do it.

Although you'll maybe need to check the default policies, especially for the FORWARD chain (iptables -P FORWARD ACCEPT/DROP).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.