Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a gateway+webserver box with multiple outside interfaces to service multiple SSL sites. I'm using plain simple iptables script as a firewall.

The default outgoing interface is eth0 (81.20.146.231). I need to have the connections initiated from the internal address 172.16.1.2 to be routed out via eth0:2, so that the outside world would see those connections originating from 81.20.146.227.

root@gateway:~# ifconfig
eth0      Link encap:Ethernet  HWaddr 00:50:56:b5:30:22
          inet addr:81.20.146.231  Bcast:81.20.146.255  Mask:255.255.255.224
          inet6 addr: fe80::250:56ff:feb5:3022/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:24106762 errors:0 dropped:0 overruns:0 frame:0
          TX packets:34661833 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:4700635137 (4.7 GB)  TX bytes:32948653469 (32.9 GB)

eth0:1    Link encap:Ethernet  HWaddr 00:50:56:b5:30:22
          inet addr:81.20.146.238  Bcast:81.20.146.255  Mask:255.255.255.224
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

eth0:2    Link encap:Ethernet  HWaddr 00:50:56:b5:30:22
          inet addr:81.20.146.227  Bcast:81.20.146.255  Mask:255.255.255.224
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

eth1      Link encap:Ethernet  HWaddr 00:50:56:b5:24:5c
          inet addr:172.16.1.1  Bcast:172.16.1.255  Mask:255.255.255.0
          inet6 addr: fe80::250:56ff:feb5:245c/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:34158142 errors:0 dropped:0 overruns:0 frame:0
          TX packets:22922477 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:32020841479 (32.0 GB)  TX bytes:3309207778 (3.3 GB)
...
share|improve this question
    
Have you seen this: serverfault.com/questions/188214/… –  Nils Magne Lunde Apr 13 '11 at 8:26
    
I had not. Had to modify from -A to -I and it worked: iptables -t nat -I POSTROUTING -s 172.16.1.2 -j SNAT --to-source 81.20.146.227. Thanks! –  Henno Apr 13 '11 at 8:38

2 Answers 2

This should do it, if I understand correctly, and will affect outbound traffic from the box to 172.16.1.2 via 81.20.146.227:

route add -host 172.16.1.2 gw 81.20.146.227

If that isn't what you're after then please explain what you're trying to achieve. If you're looking for 172.16.1.2 to answer on 81.20.146.227 then that's more complex.

share|improve this answer
    
I am sorry. My question indeed could be understood in multiple ways. I will fix that. I was looking for a way which would result the outside world to see connections initiated from the internal IP of 172.16.1.2 to appear as being made from 81.20.146.227. But only in case of that specific internal IP. When a connection is made from any other internal IP, the outside world should see it as originating from 81.20.146.231. –  Henno Apr 15 '11 at 5:54
    
I rephrased the question to eliminate the possibility for different ways to understand it. Actually I already solved my problem thanks to the comment of Ole_Brun. –  Henno Apr 15 '11 at 6:01
    
Glad to hear it's fixed. –  Jonathan Ross Apr 15 '11 at 6:23
up vote 0 down vote accepted
iptables -t nat -I POSTROUTING -s 172.16.1.2 -j SNAT --to-source 81.20.146.227
share|improve this answer
    
Shouldn't that be PREROUTING as you want to alter the packet before the kernel makes a routing decision? –  Red Tux May 2 '11 at 17:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.