I have one "server A" that has multiple IPs attached to it, like so:
eth0:0 126.96.36.199 eth0:1 188.8.131.52 eth0:2 184.108.40.206
I have another "server B" that also has multiple IPs attached to it, like so:
eth0:0 220.127.116.11 eth0:1 18.104.22.168 eth0:2 22.214.171.124
Now, I want to setup iptables on "Server A" to forward/NAT all incomming traffic on "eth0:2" to IP 126.96.36.199 on "Server B".
I have verified that "Server A" is able to "talk" to "Server B" on IP 188.8.131.52. Ping and telnet to open ports works just fine and I have the forward-flag turned on (net.ipv4.ip_forward=1)
I have tried multiple different ways, DNAT, SNAT, MASQUERADE etc, but I cannot get anything to work.
This line works fine if I try to forward traffic between IPs on the SAME server:
iptables -t nat -A PREROUTING -d 184.108.40.206 -j DNAT --to-destination 220.127.116.11
But if I switch out the "18.104.22.168" for "22.214.171.124", it does not work.
I assume that I need a second iptable rule to solve it. I have tried with the following POSTROUTING rules without any luck (not at the same time):
iptables -t nat -A POSTROUTING -d 126.96.36.199 -j MASQUERADE iptables -t nat -A POSTROUTING -d 188.8.131.52 -j SNAT --to 184.108.40.206 iptables -t nat -A POSTROUTING -j MASQUERADE
What am I missing?
I finally got it to work by using the following:
net.bridge.bridge-nf-call-iptables=0 iptables -t nat -A PREROUTING -d 220.127.116.11 -j DNAT --to-destination 18.104.22.168 iptables -t nat -A POSTROUTING -d 22.214.171.124 -j SNAT --to 126.96.36.199
However, now another problem appeared. All logs etc on server 188.8.131.52 shows that ALL traffic now comes from 184.108.40.206, like apache logs, mail logs etc. I assume this is the nature of NAT.
However, when I do standard port forwarding on my home-router to my laptop that is running apache, I see the original "requester IP" in the logs. So, how does the router do this? And how can I do the same on my server setup?
Bottom line, I want to forward all traffic from Server A (220.127.116.11) to Server B (18.104.22.168), BUT I also want to be able to see where the traffic came from on Server B (22.214.171.124), i.e the apache logs should show the original IP of the requester.
I assume I should use some other way than NAT to make this happen, and it should be possible, as even my simple home-router is able to do this.
One extra thing, the IPs attached to Server A and Server B is LOCKED to each respective server. Thus, Server A is NOT able to send out traffic FROM IP 126.96.36.199. It is locked by my provider in the router.