Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a WAN router which is linked to isp over a /30 WAN subnet. But it also servers as a router to a /29 local public WAN subnet which is connected to few of my servers. The traffic from /29 gets routed to ISP via /30 subnet. For a wired reason I want to masqarade (NAT) the interface which has /30 ip. So the interface with /30 ip should appear as masquaraded for my 192.168.1.0/24 network and it also should act as a normal non-NAT router for my WAN public subnet /29. Can this be done with iptables on a Linux machine?

EDIT1: How my firewall rules are at present:

iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X

iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT

#WAN Security
iptables -A INPUT -d 1.2.3.3 -m state --state INVALID -j DROP
iptables -A INPUT -d 1.2.3.3 -m state --state ESTABLISHED,RELATED -j ACCEPT

#NAT
iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth0 -j SNAT --to-source 1.2.3.3

#FORWARD
iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT


iptables -A INPUT -d 1.2.3.3 -j DROP
share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

Yes, this will work just fine. Set up your packet filtering and your routing just like you would if you weren't using any NAT at all and then add something like:

iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth0 -j SNAT --to-source 1.2.3.3

(Assuming that your ISP is connected to eth0, and your public IP is 1.2.3.3.)

This will apply the NAT only to packets coming from your LAN with private IP addresses.

share|improve this answer
    
How would I filter ports on 1.2.3.3 (firewall), without affecting my /29 subnet? –  nixnotwin Nov 26 '11 at 17:28
1  
Use the -d flag of iptables to filter traffic destined only for 1.2.3.3. –  Per von Zweigbergk Nov 26 '11 at 18:29
    
I have only two interfaces. So eth0 will be 1.2.3.3/30. So can I have other one like this: eth1 192.168.1.1/24 and eth1:0 as 1.2.4.77/29? –  nixnotwin Nov 29 '11 at 14:26
    
There's no reason I can think of that wouldn't work. But in general I'd recommend against having multiple IP subnets on a single Ethernet network. Even if you have only two physical interfaces on the router, you can still use VLANs to partition your Ethernet network. –  Per von Zweigbergk Nov 30 '11 at 2:31
    
I have updated my question with my final iptables rules. Any suggestions or advice? –  nixnotwin Nov 30 '11 at 5:35
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.