Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I don't know how to do it, but I need a iptables rule natting my outbound traffic to 192.168.0.1 as 192.168.1.3. How to do it?

Just to let you know:

192.168.0.1 is my target destination and is part of another network. 192.168.1.3 is the IP address that my packets should come from to the gateway to achieve the target 192.168.0.1.

Can someone give me an practical example?

Thanks.

share|improve this question

migrated from stackoverflow.com Aug 14 '12 at 18:27

This question came from our site for professional and enthusiast programmers.

    
Does your system have the IP address of 192.168.1.3? If not, then how are you expecting the replies to get back to you? –  Zoredache Aug 14 '12 at 18:29

2 Answers 2

Lets say you have an interface eth0 with network 10.0.0.0/24 where your client resides and you have another interface eth1 with IP 192.168.1.3 and you can reach your destination (192.168.0.1) using this interface

iptables -t nat -A POSTROUTING -i eth0 -d 192.168.0.1 -j SNAT --to-source 192.168.1.3

OR

iptables -t nat -A POSTROUTING -i eth0 -d 192.168.0.1 -j MASQUERADE

will both work. But if you don't have an interface with the IP 192.168.1.3 (eth1 has some other IP) then only the first one will work and that too ONLY if whatever IP you have on eth1 is in your next hop's routing table as the route to 192.168.1.0/24. As the comment on your question mentions you must have 192.168.1.3 as your interface IP or the router connected to you MUST know that if it needs to send stuff to 192.168.1.3 it should send it towards your interface. Hope that explains it.

share|improve this answer

If you simply set up NAT on the router you are immediately behind, and make sure the 192.168.1.0/24 subnet doesn't exist on your side of it, it will automatically treat that address as an Internet address and do NAT for you. That it is an RFC1918 address is of no consequence.

The packets will appear to come from the NAT host. If that is not 192.168.1.3, you can't do that (the packets' return path would be invalid).

However, depending on your network architecture, you may not need NAT between those subnets. It is perfectly legitimate to use a routing protocol (like RIP) and allow the routers to route between those two subnets. The only implication of using RFC1918 addresses in this case is that you can't traverse the public Internet using them; on your intranet they can be used like any other address, including for subnetting and routing.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.