Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm setting up a test lab situation where multiple computers will have the same IP addresses, so they need vlan separation. For example, a group of virtual machines will have IPs,, etc. And another group of virtual machines will also have the same IPs.

I want to provide NAT mappings to each of the virtual machines so that each of them can be publicly accessible. I'm using Ubuntu 11.04 with iptables.

Note: I'm normally a Windows admin, but Linux was the better solution here.

So basically I want the iptables NAT mapping to point to a specific interface and allow multiple duplicate IPs to co-exist.

Is this possible with a single Ubuntu device? I'm using virtual networking fabric so I don't have a physical network device in-between all of these.

Here's a diagram to represent it:

enter image description here

My NAT rules may be something like this:

iptables -t nat -I PREROUTING -d -j DNAT --to-destination -o eth1.5
iptables -t nat -I POSTROUTING -s -j SNAT --to-source -i eth1.5

It's the -i and -o that seem to only work with the public NIC so that's the part that I couldn't quite get working. For example, using -i in the POSTROUTING (SNAT) gives this error: Can't use -i with POSTROUTING. -o does the same with DNAT.

Any suggestions on which way to go to achieve this?

share|improve this question
Did you ever implement this? – polynomial Sep 5 '11 at 22:21
Not yet. I'm sure it's possible but I got sidetracked on other projects and haven't gotten back to it. I was told in that it's not possible, but I can't imagine that being the case. – Scott Forsyth - MVP Sep 6 '11 at 13:21
That sounds like a challenge! I'm pretty sure you could do this but you'd need to change the layout a little bit. I think you need to come up with another set IP actual unique IPs and 'iptables mangle' the packets as they come in VLAN5 and 6 to the ubuntu box. That way when it is making routing/nat decisions it is dealing with unique IPs that have specific paths(no need to mess with dnat/snat w.r.t. interfaces). Then on the outbound from the ubuntu box remangle the IPs back into space. – polynomial Sep 6 '11 at 15:36
Thanks polynomial. I would like to be able to do that but I'm stuck with pre-configured machines (virtual machines actually) that are fixed with static IPs. It's a lab situation. So, I can't specify them. I would think that there should be a way to flag which interface the ports are on to be able to tell the difference. I have a feeling that I may need to use the FORWARD chain, or else using the postrouting change differently. This link has a diagram of the flow – Scott Forsyth - MVP Sep 7 '11 at 14:10

You need to use a second NAT to get around your problem---create a 4th VM with distinct IPs on either VLAN and have it do a second layer of NAT to hit the actual hosts on the 4th VM's VLAN. You could also create those 4th VMs on the Ubuntu SPF, of course.

I do have to ask the question, however: why do you want to do this---could you just have two Ubuntu boxes, one on 5, one on 6?

share|improve this answer
I was in a similar situation (lab environment, multiple setups with the same IP space behind them for preconfigured machines) and did exactly that. Turned out to be WAY more complicated than it ought to be. Keep It Simple. – MikeyB Sep 29 '11 at 1:25
For me it was a WAN link to a vendor that wanted to eat some RFC1918 space we couldn't easily re-address---hence my question of why he wanted to do this (updated to clarify). – James Cape Sep 29 '11 at 1:33
Thanks James (and MikeyB). I'll try that out. This situation is a lab situation where the labs are pre-configured before I obtain them, and they need to keep their same IPs. They are a set of a 1/2 dozen lab machines that need to inter communicate. That's why they can't change, but why they need to have identical IP addresses. There will be more than just 2 though. Two was just for the example. I could drop an Ubuntu device in each network/lab, which I believe is what you're saying. I've set the project aside for now but when I get back to it, this is what I'll try. – Scott Forsyth - MVP Sep 29 '11 at 19:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.