Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am doing NAT traffic forwarding using iptables (1.1.1.1 => 2.2.2.2) with the following commands:

iptables -t nat -A PREROUTING -d 1.1.1.1 -j DNAT --to-destination 2.2.2.2
iptables -t nat -A POSTROUTING -d 2.2.2.2 -j SNAT --to 1.1.1.1

It works fine except for one thing: If I check apache logs, doing firewall rules etc. on server 2.2.2.2, it looks like all traffic is comming from 1.1.1.1.

Of course it makes a bit sense, since it is 1.1.1.1 that is forwarding the traffic to 2.2.2.2, but I assumed NAT would pass the original IP "requestor" in the package?

Is there a way to make the traffic to 2.2.2.2 have the "real" orignal IP?

Currently, it makes it very difficult to setup good firewall rules and other security stuff as ALL traffic seems to be comming from 1.1.1.1 regardless what the original traffic is actually comming from.

share|improve this question
    
I did not understand your rules well. If you want to redirect the traffic destined to 1.1.1.1 to be destined to 2.2.2.2, the first rule should be enough. In this case, you will see the original requester IP address. Using both rules, you are changing both the source and destination addresses!! –  Khaled Jul 16 '13 at 10:43
    
Without the SNAT rule, traffic will never get back to the original client properly, so the DNAT by itself is insufficient. –  John Jul 16 '13 at 12:03

1 Answer 1

Apache will never see the IP behind the NAT. The endpoint system, 2.2.2.2, doesn't know about anything outside of 1.1.1.1. The only way to get the original requestor's IP is to embed some sort of javascript or client-side code that runs the equivalent of ipconfig or ifconfig on the client and hands that output off to the web server as part of a POST. This is generally frowned upon, however.

share|improve this answer
    
So you are basically saying that I cannot put any IP-based firewall rules on the 2.2.2.2 server, as it will see ALL incomming traffic as 1.1.1.1? –  Daniele Testa Jul 16 '13 at 12:20
    
No, I'm saying you cannot put any NAT rules in place. It amounts to the same thing in practice, but the "firewall" rules blocking access to certain ports are different from "NAT" rules telling packets where to go. –  John Jul 16 '13 at 12:24
    
After some digging around, this can not be true. Computers behind the NAT "router" should still see the requests comming in as from the original IP. –  Daniele Testa Jul 16 '13 at 12:31
    
Ok, so how would "reserve proxy" iptable rules looks like that accomplishes this? I know NAT is usually used for outgoing traffic and I am trying to forward incomming traffic instead. Incomming traffic to 1.1.1.1 should be forwarded to 2.2.2.2 and the response comming from 2.2.2.2 should, of course, be routed back to 1.1.1.1 –  Daniele Testa Jul 16 '13 at 12:34
1  
What you want cannot be accomplished via iptables. A NAT router will always hide the external IP address. An outgoing NAT always hides internal addresses (e.g. a home network) and gives only the one public address you have from (as an example) AT&T to external web servers. That is how it works. Are there other, more complicated solutions that may give you what you want? I wouldn't be surprised. Are they worth the time to figure out? I don't think so. –  John Jul 16 '13 at 12:37

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.