I have a system hosting a number of KVM instances. All of these are connected to a single bridge (say,
brvirt), to which is also connected
eth1. This layer 2 environment is on a private network using 172.16.10.0/24 for an address change. There are two other interfaces on the system that we'll call
eth0 (10.10.10.10) and
In general, external connectivity is provided via
SNAT to the address of
eth0 (and the hosts's default gateway is also out this interface). For some systems, I want an explicit 1-1
SNAT rule on the 10.10.20.0/24 network, which is attached to
This is a problem because by the time we hit the
POSTROUTING chain to perform the
SNAT the outbound interface selection has already been made. The kernel has already selected the default route (assuming a connection to anything other than a directly attached network), which means that when the
SNAT rule modifies the source ip address, the local routing infrastructure drops the packet because it is originating on the wrong layer 2 network.
Is there any way around this? What I really want to do is make routing decisions based on the source address on the packet at the conclusion of the
POSTROUTING chain...but it's called
POSTROUTING for a good reason.