Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to implement a 1 to 1 NAT on a Linux Box. The setup is pretty basic, it has two interfaces, eth0 is the outside interface, eth1 is the inside. Behind eth1 resides the isolated 192.168.100.0/24 network while eth0 connects to the rest of the network on 192.168.0.0/24 (this network is irrelevant). What I want to do is allow the isolated network to communicate through the linux box using an external IP address of a different network, 192.168.50.0/24. So basically the linux box nats 192.168.100.10 from the inside network to 192.168.50.10 routed out of the linux box. I've set up routes to point traffic destined for 192.168.50.0/24 to the Linux box's eth0 interface on all external devices.

At this point, traffic destined for 192.168.50.0/24 arrives at eth0 of the Linux box, but it never seems to translate over as I never see any traffic for either 192.168.50.10 or 192.168.100.10 on the internal eth1 interface. Below is my basic NAT config. My question is, do I need to do something else? I didn't bother adding routes on the Linux box for the 192.168.50.0/24 network since the box never routes packets with that address due to this NAT config.

Outbound rule

-A POSTROUTING -o eth0 -s 192.168.100.10 -j SNAT --to-source 192.168.50.10

Inbound rule

-A PREROUTING -i eth0 -d 192.168.50.10 -j DNAT --to-destination 192.168.100.10

Temp rules to allow all traffic

-A INPUT -j ACCEPT
-A FORWARD -j ACCEPT

Notice all other traffic is allowed through iptables as well by default, so it shouldn't be a blocking issue.

share|improve this question

2 Answers 2

You need to confirm you have the following conditions met:

  1. Enable the IP forwarding using: echo 1 > /proc/sys/net/ipv4/ip_forward or by setting the appropriate line in /etc/sysctl.conf.
  2. Allow the traffic to pass through the box which should be OK according to your description.
  3. Setup the needed NAT rules which should be OK according to your description.
  4. Setup the needed routes (static or dynamic) if the routed IPs belong to subnets not directly connected to the Linux router. This should be also OK according to your description.

It seems that you are left with the first point!

share|improve this answer
    
As soon as you listed #1, I knew that was the problem. I got bit by that on an OpenVPN install and completely forgot about that setting. Sure enough, flipping that on fixed the issue, thank you very much for providing that information. –  Brandon Dec 7 '11 at 23:17

It may be an ARP issue. See the Shorewall One-to-one Nat notes. I tend to prefer a firewall builder tool like Shorewall for things like this.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.