Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote -2 down vote favorite

I need to set up routing, preferably with iptables, that does no NAT. Basically I will have a number of clients on subnet 192.168.1.0/24 and they need their traffic to go through a gateway, say 192.168.1.1 and that gateway then passes on the request, without translating the original address, to another gateway, say 192.168.0.100. What I really want to do is use iptables so I can configure a fine grain firewall to do the routing but all I can find info on is how to do this with NAT. Which I have done before. Any insight on how to do the routing without NAT?

share|improve this question
1  
"assigning us a Class C subnet" -- I'll bet they aren't. – womble Aug 5 '12 at 0:08
Our institution owns a Class B block of public addresses. They are assigning us a Class C block. Why do you say they are not? – Erik Weiss Aug 5 '12 at 0:12
4  
If your institution "owns" a class B subnet, they cannot, by the very definition of a classful addressing, assign you a class C subnet out of that block. Cannot be done. That's before we start into the issue of classful addressing being declared obsolete over 20 years ago... – womble Aug 5 '12 at 0:20
Fair enough, call it what you like, but they are "allocating" us a class C subnet of addresses and I am stumped on how to do the routing with iptables. I will edit my original question to generalize it. – Erik Weiss Aug 5 '12 at 0:27
2  
They're not allocating you a class C subnet either. Classful addressing is dead. – womble Aug 5 '12 at 0:38
show 2 more comments

2 Answers

up vote 1 down vote

Routing without NAT is just like routing with NAT... only without the NAT. You add routing table entries to indicate next-hop destinations.

Firewalling without NAT is just like firewalling with NAT... only without the NAT. You add firewall rules to permit traffic with certain attributes (source/dest addresses and ports, protocols, state parameters, etc) in like with organisational policy.

share|improve this answer
up vote 1 down vote

No need nat here, add your deny/accept rules to FORWARD chain of filter table,

also don't forget to enable forwading on both devices:

echo 1 > /proc/sys/net/ipv4/conf/all/forwarding

or setup it via sysctl (net.ipv4.conf.all.forwading=1 in /etc/sysctl.conf)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.