Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have installed virtual box ( with Two virtual Adapters(NAT-type)) - Host (Ubuntu -10.10) - Guest-Opensuse-11.4. My Objective is to simulate all four types of NAT as defined here. Simulating the various kinds of NATs can be done using Linux iptables. In these examples, eth0 is the private network and eth1 is the public network.


iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source <public ip goes here>
iptables -t nat -A PREROUTING -i eth0 -j DNAT --to-destination <private ip goes here>

Restricted cone:

iptables -t nat POSTROUTING -o eth1 -p tcp -j SNAT --to-source <public ip goes here> 
iptables -t nat POSTROUTING -o eth1  -p udp -j SNAT --to-source <public ip goes here> 
iptables -t nat PREROUTING -i eth1 -p tcp -j DNAT --to-destination <private ip goes here> 
iptables -t nat PREROUTING -i eth1 -p udp -j DNAT --to-destination <private ip goes here> 
iptables -A INPUT -i eth1 -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT 
iptables -A INPUT -i eth1 -p udp -m state --state ESTABLISHED,RELATED -j ACCEPT 
iptables -A INPUT -i eth1 -p tcp -m state --state NEW -j DROP 
iptables -A INPUT -i eth1 -p udp -m state --state NEW -j DROP 

Port-restricted cone:

 iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source <public ip goes here>


echo "1" > /proc/sys/net/ipv4/ip_forward
iptables --flush
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE --random
iptables -A FORWARD -i eth1 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT

I setup an OpenSuse guest with Two Virtual adapters, eth0 and eth1.

  • eth1 with address / eth1:1 as
  • eth0 with address

Then ran the stund client/server...


eKimchi@linux-6j9k:~/sw/stun/stund> ./server -v -h -a


eKimchi@linux-6j9k:~/sw/stun/stund> ./client -v -i

...on all Four Cases It is giving same results :

test I = 1 test II = 1 test III = 1 test I(2) = 1 is nat = 0 mapped IP same = 1 hairpin = 1 preserver port = 1 Primary: Open Return value is 0x000001

Q-1: Please let me know If any has ever done, It should behave like NAT as per description but nowhere it working as a NAT.

Q-2: How NAT Implemented in Home routers (Usually Port Restricted), but those also pre-configured iptables rules and tuned Linux

share|improve this question

If you want to "control" the different types of NAT with the guests running under any kind of hypervisor, then you need to run the guests under the "bridged" networking mode.

share|improve this answer
My Overall Objective is NAT Simulation on same guest machine, If I have 3-4 Virtual Adapters in that, then I should be able to configure above NAT rules via iptables. and just on same machine (same Virtual Box Instance), I should be able to run stund client/server (bind it on specific interface) and if I set Port Restricted rules then result (stund client/server) should Port Restricted like that. / but its not happening !! On packet capture it doesn't capture from eth0 or eth-1 It captures from Pseudo Interfaces !! – Sumit Arora Jun 27 '11 at 7:54
Are the NICs on the guests in bridged mode (e.g. no NAT from the hypervisor)? – user48838 Jun 27 '11 at 8:06
Yes NICs are on Bridge Mode – Sumit Arora Jun 27 '11 at 8:26
Where are you running the packet captures and what is it looking at/for? – user48838 Jun 27 '11 at 8:46
I am running Packet Captures in Guest Machine Ubuntu ( with Two Virtual Adapters - eth0 and eth1) e.g; Configured rule for Port Restricted from above (iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source <public ip goes here>) , But while capturing the packets - I saw - Packets are not picked up from eth0 or eth1 interface, packets are picked up from pseudo-device Interface. While rules are configured based on eth0-eth1 interfaces , [On Packet movement nothing filtered up via iptables] – Sumit Arora Jun 27 '11 at 8:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.