We have a private LAN connected to a firewall with multiple public IP's to use for SNAT in order not to overload the ports on a single IP. However, we have a requirement to allow certain workstations to be externally accessible on pre-defined ports that they host servers on.
In the example below, machine A has previously communicated to B a resource available on 203.0.113.1:7045. However, when machine B initiates a connection to A it will likely receive its response with a source IP different to what it expects (Because of the SNAT round robin).
I assume this must be an issue for machine B as it would not be able to correctly associate the packet in order to create the connection. What is the best solution?
iptables -t NAT -A POSTROUTING -s 10.8.4.0/24 -o eth1 -j SNAT --to-source 203.0.113.1-203.0.113-3 iptables -t NAT -A PREROUTING -i eth1 -m multiport --dports 7045:7059 -j DNAT --to-destination 10.8.4.2