Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a private LAN connected to a firewall with multiple public IP's to use for SNAT in order not to overload the ports on a single IP. However, we have a requirement to allow certain workstations to be externally accessible on pre-defined ports that they host servers on.

In the example below, machine A has previously communicated to B a resource available on 203.0.113.1:7045. However, when machine B initiates a connection to A it will likely receive its response with a source IP different to what it expects (Because of the SNAT round robin).

I assume this must be an issue for machine B as it would not be able to correctly associate the packet in order to create the connection. What is the best solution?

iptables -t NAT -A POSTROUTING -s 10.8.4.0/24 -o eth1 -j SNAT --to-source 203.0.113.1-203.0.113-3
iptables -t NAT -A PREROUTING -i eth1 -m multiport --dports 7045:7059 -j DNAT --to-destination 10.8.4.2

SNAT with multiple source IP's and static DNAT

share|improve this question

1 Answer 1

up vote 1 down vote accepted

I don't think there's a problem at all since incoming connections would have their own state entries which wouldn't overlap with outgoing ones. Are your problem real or just imaginary?

share|improve this answer
    
So if I understand correctly, the connection tracking table would remember that the destination address was 203.0.113.1 and would use this same IP when doing SNAT for the remainder of the connection? At this stage I'm just designing the solution so the problem is 'imaginary' you could say. Any explanation would be greatly appreciated. –  Michelle May 20 '13 at 10:30
    
Yep. It should work that way. –  poige May 20 '13 at 10:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.