up vote 0 down vote favorite
share [g+] share [fb]

I want an Ubuntu server machine to act as a bidirectional NAT. It has 2 NICs, each connected to a different network. I want it to forward connections received on eth1 at certain ports to certain addresses/ports at the network connected to eth2; and vice versa. I managed to do this by configuring DNAT in the PREROUTING of nat table, and SNAT in the POSTROUTING. The problem begins when both networks happen to be in the same subnet, e.g. 192.168.x.x. I want to make sure that packets received at eth1 are forwarded via eth2 and vice versa, even if there is a single IP address used as a destination address for 2 different machines, one in each network. I thought of using packet marking at the mangle table, in order to set a mark representing the original incoming interface, and then use fwmark to route packets with different marks through different outgoing interfaces. However, I'm not sure whether using this technique really let me choose the outgoing interface, and not only the gateway.

Does any one have an idea how to get this done?

link|improve this question
To what end? curiously? what is the point of this? You lost me when you said its going to be the same subnet on both ends – SpacemanSpiff Dec 25 '11 at 15:05
I don't fully understand this: how can two machines be in the same subnet, even have the same IP address, but be accessed by the server via different NICs? That should lead to a heap of routing problems. – G. Bach Dec 27 '11 at 13:50
They can be in the same address space but a separated physical network. This can happen if there are two private networks with the same address space, and a machine with two NICs is connected to both. – router Dec 27 '11 at 15:23
Oh, you are talking about address space - I though you literally meant the same network (as in physically connected to the same network hub for example). Then my question becomes: how do you make the routing work? If you have two machines in two subnets (nets A and B) and in both networks there's a machine with the IP X.X.X.X, then if a machine in A sends packets to X.X.X.X they will probably never be picked up by the router, so they will never have a chance to reach network B. – G. Bach Dec 28 '11 at 1:53
That was the case if I used my machine as a default gateway, but not when using it as a NAT. The machine in A can send packets to the explicit IP address of the NAT machine in A network. According to the port, the NAT machine can determine the actual destination IP and NAT in network B. – router Dec 29 '11 at 17:31
feedback

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer

 
or
required, but never shown
discard

Browse other questions tagged or ask your own question.