Here is what i want to do:
I have a bunch of systems, some might have the same Public-IP, i disable ARP. I have a Firewall (either IP Layer or bridge-FW) between these systems and the internet. Depending on the destination port of incoming IP-Packets to some of these Public-IPs i want to set the destinsation-Ethernet-Adress. So for instance
System A has IP 220.127.116.11, mac de:ad:be:ef:de:ad, arp disabled System B has IP 18.104.22.168, mac 1f:1f:1f:1f:1f:1f, arp disabled
Firewall has IP 22.214.171.124, arp disabled on that interface
- Incoming packet to IP 126.96.36.199 tcp dest port 100
- Incoming packet to IP 188.8.131.52 tcp dest port 101
Firewall sets dest-mac for 1.) -> de:ad:be:ef:de:ad Firewall sets dest-mac for 2.) -> 1f:1f:1f:1f:1f:1f
System A and System B establish outgoing TCP-Connections, and the firewall matches the dst-mac of the incoming IP-Packets (response packets) to the senders-mac address.
is this possible in any way with linux and iptables?
edit: i read ebtables might "work" in a hackish way for this purpose but i am not sure...