Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Here is what i want to do:

I have a bunch of systems, some might have the same Public-IP, i disable ARP. I have a Firewall (either IP Layer or bridge-FW) between these systems and the internet. Depending on the destination port of incoming IP-Packets to some of these Public-IPs i want to set the destinsation-Ethernet-Adress. So for instance

System A has IP, mac de:ad:be:ef:de:ad, arp disabled System B has IP, mac 1f:1f:1f:1f:1f:1f, arp disabled

Firewall has IP, arp disabled on that interface

  1. Incoming packet to IP tcp dest port 100
  2. Incoming packet to IP tcp dest port 101

Firewall sets dest-mac for 1.) -> de:ad:be:ef:de:ad Firewall sets dest-mac for 2.) -> 1f:1f:1f:1f:1f:1f

Second scenario:

System A and System B establish outgoing TCP-Connections, and the firewall matches the dst-mac of the incoming IP-Packets (response packets) to the senders-mac address.

is this possible in any way with linux and iptables?

edit: i read ebtables might "work" in a hackish way for this purpose but i am not sure...

share|improve this question
Looks to me like you're trying to solve what's already been solved several times over with a more elegant solutions. – Matt Nov 28 '12 at 20:50

What you're trying to do is called port-forwarding, and is typically done via NAT. (Incoming traffic on the public IP gets forwarded to a different private IP based on the port at which it arrives.)

Doing this via MAC address seems like an unnecessary complication.

share|improve this answer
i am well aware of port forwarding and NAT, but they are no options for me, because the end services have three requirements: 1.) they need to have a public IP and 2.) due to load balancing they may have different mac addreses 3.) due to limited public IPs several machines might have the same ip – d-fens Nov 28 '12 at 16:41
Alright, well, good luck with that, then. IPv6, FTW. – HopelessN00b Nov 28 '12 at 16:43
yeah ipv6 would obviously be the clean solution, unfortunately that doesnt help me atm because the services cant even use ipv6 yet – d-fens Nov 28 '12 at 16:50
@d-fens Yeah, honestly sounds like you're just outta luck... I'd probably suggest to the suits that it would be a lot cheaper to buy more public IPs than to try to code through this... mess. – HopelessN00b Nov 28 '12 at 16:59
@d-fens - mac addresses are not routed. It's irrelevant that the MAC is different. – Matt Nov 28 '12 at 21:14

Why get so complicated? Install a proxy or load balancer like haproxy and do everything at the layer 3 level.

share|improve this answer
i have services i load balance. these services must bind() to a public IP and even establish outgoing connections through this public IP. Due to load balancing the services might end up on different nodes. Due to oforementioned necessity of public IPs, different nodes might have the same ip, for example a service A and B has both bind() to but service B was later migrated to another node. – d-fens Nov 28 '12 at 16:44

One method which may work well for you is by using a the nth module in iptables. I haven't tested this but in theory you should be able to make this work.

For example:

Will load balance requests to port 100 to 2 internal servers.

iptables -A PREROUTING -i eth0 -p tcp --dport 100 -m state --state NEW -m nth --counter 0 --every 2 --packet 0 -j DNAT --to-destination

iptables -A PREROUTING -i eth0 -p tcp --dport 100 -m state --state NEW -m nth --counter 0 --every 2 --packet 1 -j DNAT --to-destination

By the way, firewall can still have address if you like and also You can write NAT rules so that traffic coming from those servers exiting the firewall will use as their source. Any other traffic behind the firewall can use as the source.

Something like the following may work.

iptables -t nat -A POSTROUTING -s -o eth0 -j SNAT --to-source

Where only ip's from - are allowed. i.e. your servers

And for the rest of the network

iptables -t nat -A POSTROUTING -s -o eth0 -j SNAT --to-source

Yeah I know, the 30 range is inside the 24 range. iptables will hit the first rule and NAT to (I think).

share|improve this answer
Nat is not going to work unfortunately, because the services use the bind() socket parameters to propagate the service to third party directories. For instance if i use 192.168.x.x that IP would be propagated to the lookup directory, regardless what kind of NAT-foo i make. – d-fens Nov 29 '12 at 10:30
ok, can you change that logic? what happens when you need to change public IP? isn't this all going to come crashing down in a big heap? – Matt Nov 30 '12 at 0:01
What about putting each machine in a different VLAN bound to the same IP? then you can route by VLAN – Matt Nov 30 '12 at 0:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.