Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a dedicated machine which has 2 VMs running. Host A (Router):

eth0 192.0.2.8
eth1 10.0.0.1

and I have

Host B(Application Server)
eth0 10.0.0.2

My IPTables config is:

modprobe iptable_nat
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A FORWARD -i eth1 -j ACCEPT
iptables -A FORWARD -i eth2 -j ACCEPT

and an example firewall forward I use would be

iptables -t nat -A PREROUTING -p tcp -i eth0 -d 192.0.2.8 --dport 25565 -j DNAT --to 10.0.0.2:25565

in all of my logs for applications they say all requests are coming from my external IP 192.0.2.8

What can I do to make it so that packets show the original source address and not 192.0.2.8?

share|improve this question
2  
If you don't want NAT, why are you using NAT? –  Michael Hampton May 20 '13 at 2:41
    
I have multiple VMs behind one IP address. What else would I do instead of NAT? –  Jamie H May 20 '13 at 2:42
    
He's asking because what you're describing as a problem is actually the main purpose of source NAT: To allow multiple hosts to share a public IP. Do you have multiple public IPs assigned to your router? –  s.co.tt May 20 '13 at 2:45
    
I only have the 1 IP on my router. It would cost me quite a bit more to add another address so I'm trying to share the one address with multiple hosts. I want mutiple hosts to be able to share one public IP but if I have a web server running it shows all of the traffic coming from the external IP not the IP of the client. –  Jamie H May 20 '13 at 2:55
    
Put the web server on the 10. net. –  dmourati May 20 '13 at 5:28
add comment

closed as too localized by Ward, MadHatter, Michael Hampton, Jenny D, Chris S May 20 '13 at 13:43

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer

What you need to do is to remove the NAT and instead do port forwarding to proxy servers for each port that you are serving.

The proxy servers then send the requests to the appropriate servers for the domain specified in the request. For example, for port 80, set up Apache2 as a reverse proxy as explained in this IBM article.

For email set up a relay host. For other services you will need to find appropriate proxies.

share|improve this answer
    
Not very useful as there are quote a few different applications which don't won't be supported by a proxy. –  Jamie H May 20 '13 at 14:14
    
@JamieH: Can you list the applications? –  Jonathan Ben-Avraham May 20 '13 at 14:20
    
Things like Minecraft, Game Servers and that kind of stuff. I already have Nginx proxying things like Web Servers. –  Jamie H May 20 '13 at 18:03
    
@JamieH: Your OP NAT rule, implies that you have only one server per application. If that is the case, you can just use iptables to port forward directly to the appropriate server without using NAT or a proxy. If you have multiple Minecraft type servers, then your only option is to use both direct port forwarding and port separation on the client side. That is to tell the clients to connect to your external IP address but to use different ports depending on which server they want to use. In any event, In any event, I upvoted the question because a lot of sys admins at smaller orgs have same Q. –  Jonathan Ben-Avraham May 20 '13 at 18:22
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.