Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have been using CSF on a virtualized (OpenVZ) environment successfully for a while combining venet and bridged interfaces so we can use public IPs + local addressed virtual systems.

Kernel IP routing table
Destination       Gateway         Genmask         Flags Metric Ref    Use Iface UH    0      0        0 venet0 UH    0      0        0 venet0   U     0      0        0 vmbr0   U     0      0        0 vmbr10         UG    0      0        0 vmbr0

We route traffic of "local" ips via an iptables rule:

iptables -t nat -A POSTROUTING -s "" -o vmbr0 -j MASQUERADE

/proc/sys/net/ipv4/ip_forward value is obvioyly set to 1

The host and venet networked machines run their own CSF installation that creates all the firewall rules for this setup which includes the possibility to create "redirects" to internal IPs.

With this we can open specific ports on the host IP that are served by the local internal virtual machines on local based network. Among the long list of firewall rules that CSF creates are:

Chain PREROUTING (policy ACCEPT 53M packets, 15G bytes)
num   pkts bytes target     prot opt in     out     source               destination         
1        0     0 DNAT       tcp  --  !lo    *            XXX.XXX.XXX.184      tcp dpt:5100 to: 

Chain POSTROUTING (policy ACCEPT 9700K packets, 615M bytes)
num   pkts bytes target     prot opt in     out     source               destination         

3        0     0 SNAT       tcp  --  *      !lo            to:XXX.XXX.XXX.184 
8       10   600 MASQUERADE  all  --  *      vmbr0           

The redirect feature on CSF firewall works but the IP reported is the host one, not the originating IP so we can not limit it with another CSF instance (or simple firewall rule) on the destination virtual system. We understand that being on PREROUTING they can not be limited on on the host CSF either.

The CSF readme actually states "All redirections to another IP address will always appear on the destination server with the source of this server, not the originating IP address." so this is a standard feature.

CSF supports a file where we could include the NAT rules manually but we are unsure if with IPTABLES SNAT and/or DNAT it is possible to pass the "real" source IP to the destination of the NAT IP.

share|improve this question

The only way to see the "real" source IP, you mentioned, at the destination is to avoid Natting or Masquerading it. Remember, SNAT and DNAT stand for Source and Destination Network TRANSLATION, respectively, so once the packet traverses the Natting rules, the source/destination addresses are "changed" for good. You can't retrieve them at the destination.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.