Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

So I have a machine with a single interface. It has 2 ip addresses (eth0: 192.168.2.3, eth0:1 192.168.2.4). I'd like to take any traffic coming in on 192.168.2.4 and NAT it to an external ip address. As best I can tell I've done everything needed to make it work, but it doesn't so I'm missing something.

/proc/sys/net/ipv4/ip_forward is set to 1

my iptables are all set to default ACCEPT, here is my DNAT rule:

iptables -t nat -A PREROUTING -d 192.168.2.4 -j DNAT --to-destination 192.1.1.2

The machine has a route to 192.1.1.2 via a gateway reachable from eth0: 192.1.1.2 192.168.2.248 255.255.255.0 UG 0 0 0 eth0

The DNAT rule doesn't seem to actually be doing any sort of NAT/redirection.

What have I missed?

share|improve this question
    
For anyone else that runs across this, I was missing the corresponding SNAT rule. Once I put that in place, it worked like magic ;). iptables -t nat -A POSTROUTING -d 192.1.1.2 -j SNAT --to-source 192.168.2.4 –  koyong Sep 19 '11 at 18:42

1 Answer 1

I'd do an iptables -t nat -L -v -n to see the counts on the DNAT rule in the PREROUTING chain. You can watch them increase with each new connection processed by the rule. If they're not being incremented then I'd start sniffing the traffic on the eth1 interface to see if the traffic is making it there.

It's likely that your FORWARD chain is set to a default drop policy and doesn't have a rule to forward this traffic. Double-check that, too.

share|improve this answer
    
All of my tables are definitely set to default allow, it seems as though iptables isn't liking my alias interface at all. I changed the NAT rule slightly so that instead of -d I was checking --dport 22 and the counts were moving, but it was also intercepting my traffic on the actual interface (which won't work). –  koyong Sep 19 '11 at 16:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.