Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm looking for a way how to nat 2 or more inner IPs (in my case xen doms) to one outer IP.
I tried to use

iptables -t nat -A PREROUTING -d 123.123.123.123 -j DNAT --to 1.2.3.4 --to 1.2.3.7
iptables -t nat -A POSTROUTING -s 1.2.3.4 -j SNAT --to 123.123.123.123
iptables -t nat -A POSTROUTING -s 1.2.3.7 -j SNAT --to 123.123.123.123

And got an error:

iptables v1.4.14: DNAT: Multiple --to-destination not supported
Try `iptables -h' or 'iptables --help' for more information.

I found this in the manpage:

Later Kernels (>= 2.6.11-rc1) don't have the ability to NAT to multiple ranges anymore.

So my question is: Why is it not possible anymore and is there a workaround? Maybe I should use an other method I don't know yet?

EDIT:
The idea is to use the system like a router, so I have one address but multiple users behind. The problem is I don't know which connection reffers to a user (for example 1.2.3.4). But I know, they all have different ports open for incomming traffic.
So my solution (for DNAT) would be to nat all incoming connections to all users and filter all unused ports, so the connection goes to one single user. For outgoing traffic I would use

iptables -A FORWARD -i eth0 -d 1.2.3.4 -m state --state ESTABLISHED,RELATED -j ACCEPT

share|improve this question
1  
I don't understand what you're trying to do. NAT isn't for load balancing, why would you possibly DNAT one public IP to multiple internal ones? Your SNAT rules would work fine for outgoing traffic, but I don't get how incoming traffic would be handled in the scenario your envision. –  gparent Jul 27 '13 at 16:17

2 Answers 2

You can't do 1-to-1 NAT with only 1 outside IP address when you're working with 2 internal hosts. The reason is because the firewall will never have a true destination for outside source connections, unless one of the internal hosts is down. In this case, you would require 2 iptables rules to provide round-robin functionality:

$ipt -t nat -A PREROUTING -s $srcip -d $wanip -j DNAT --to 192.168.1.2
$ipt -t nat -A PREROUTING -s $srcip -d $wanip -j DNAT --to 192.168.1.3

Also, your "DNAT: Multiple --to-destination not supported" error comes from the capability of specifying more than 1 DNAT destination being removed from the version you're running (v1.4.14). This functionality was removed in favor of the round-robin functionality.

If you want to allow multiple hosts a connection to the internet, you must use the POSTROUTING chain of the NAT table as follows:

$ipt -t nat -A POSTROUTING -o $wanif -s $lan_network -j MASQUERADE

MASQUERADE is used with dynamic IP configurations. For static IP, use SNAT in place of MASQUERADE:

$ipt -t nat -A POSTROUTING -o $wanif -s $lan_network -j SNAT --to $wanip

This will not, however, make the open ports on your internal hosts available to the outside world. DNAT is used for outside->inside and SNAT is used for inside->outside for basic scenarios like yours.

share|improve this answer

You could try to play with TEE target, that available via xtables-addons - http://xtables-addons.sourceforge.net/modules.php

To copy (duplicate) all traffic from and to a local ECHO server to a second box (nonfinal target)

# iptables -A PREROUTING -t mangle -p tcp --dport 7 -j TEE --gateway 1.2.3.4 --tee
# iptables -A POSTROUTING -t mangle -p tcp --sport 7 -j TEE --gateway 1.2.3.4 --tee

Also you can try http://code.google.com/p/port-mirroring/

share|improve this answer
    
I tried this, but it does not seem to work properly. I tried iptables -t mangle -A PREROUTING -i eth0 -d 123.123.123.123 -j TEE --gateway 1.2.3.7. Any idea what is wrong? –  Kaemmelot Jul 29 '13 at 20:45
    
I have to add 1.2.3.4 is working fine (used DNAT for it), but 1.2.3.7 works only for outgoing traffic. –  Kaemmelot Jul 29 '13 at 21:00

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.