Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm setting up a test lab situation where multiple computers will have the same IP addresses, so they need vlan separation. For example, a group of virtual machines will have IPs 192.168.1.200, 192.168.1.201, etc. And another group of virtual machines will also have the same IPs.

I want to provide NAT mappings to each of the virtual machines so that each of them can be publicly accessible. I'm using Ubuntu 11.04 with iptables.

Note: I'm normally a Windows admin, but Linux was the better solution here.

So basically I want the iptables NAT mapping to point to a specific interface and allow multiple duplicate IPs to co-exist.

Is this possible with a single Ubuntu device? I'm using virtual networking fabric so I don't have a physical network device in-between all of these.

Here's a diagram to represent it:

enter image description here

My NAT rules may be something like this:

iptables -t nat -I PREROUTING -d 72.73.74.75 -j DNAT --to-destination 192.168.1.200 -o eth1.5
iptables -t nat -I POSTROUTING -s 192.168.1.200 -j SNAT --to-source 72.73.74.75 -i eth1.5

It's the -i and -o that seem to only work with the public NIC so that's the part that I couldn't quite get working. For example, using -i in the POSTROUTING (SNAT) gives this error: Can't use -i with POSTROUTING. -o does the same with DNAT.

Any suggestions on which way to go to achieve this?

share|improve this question
    
Did you ever implement this? –  polynomial Sep 5 '11 at 22:21
    
Not yet. I'm sure it's possible but I got sidetracked on other projects and haven't gotten back to it. I was told in linuxforums.org that it's not possible, but I can't imagine that being the case. –  Scott Forsyth - MVP Sep 6 '11 at 13:21
    
That sounds like a challenge! I'm pretty sure you could do this but you'd need to change the layout a little bit. I think you need to come up with another set IP actual unique IPs and 'iptables mangle' the packets as they come in VLAN5 and 6 to the ubuntu box. That way when it is making routing/nat decisions it is dealing with unique IPs that have specific paths(no need to mess with dnat/snat w.r.t. interfaces). Then on the outbound from the ubuntu box remangle the IPs back into 192.168.1.0/24 space. –  polynomial Sep 6 '11 at 15:36
    
Thanks polynomial. I would like to be able to do that but I'm stuck with pre-configured machines (virtual machines actually) that are fixed with static IPs. It's a lab situation. So, I can't specify them. I would think that there should be a way to flag which interface the ports are on to be able to tell the difference. I have a feeling that I may need to use the FORWARD chain, or else using the postrouting change differently. This link has a diagram of the flow fclose.com/b/linux/816/port-forwarding-using-iptables. –  Scott Forsyth - MVP Sep 7 '11 at 14:10
add comment

1 Answer

You need to use a second NAT to get around your problem---create a 4th VM with distinct IPs on either VLAN and have it do a second layer of NAT to hit the actual hosts on the 4th VM's VLAN. You could also create those 4th VMs on the Ubuntu SPF, of course.

I do have to ask the question, however: why do you want to do this---could you just have two Ubuntu boxes, one on 5, one on 6?

share|improve this answer
1  
I was in a similar situation (lab environment, multiple setups with the same IP space behind them for preconfigured machines) and did exactly that. Turned out to be WAY more complicated than it ought to be. Keep It Simple. –  MikeyB Sep 29 '11 at 1:25
    
For me it was a WAN link to a vendor that wanted to eat some RFC1918 space we couldn't easily re-address---hence my question of why he wanted to do this (updated to clarify). –  James Cape Sep 29 '11 at 1:33
    
Thanks James (and MikeyB). I'll try that out. This situation is a lab situation where the labs are pre-configured before I obtain them, and they need to keep their same IPs. They are a set of a 1/2 dozen lab machines that need to inter communicate. That's why they can't change, but why they need to have identical IP addresses. There will be more than just 2 though. Two was just for the example. I could drop an Ubuntu device in each network/lab, which I believe is what you're saying. I've set the project aside for now but when I get back to it, this is what I'll try. –  Scott Forsyth - MVP Sep 29 '11 at 19:46
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.