I run a small network where a linux web/mail server also provides NAT for a collection of windows boxes. One of these windows machines is apparently misbehaving (ZeroAccess botnet even though I can't find any problems using Norton PowerEraser and have only been able to find 3 outgoing port 16465 packets in /var/syslog in weeks of logging). For some reason setting a firewall rule to drop all outgoing 16465 packets doesn't solve the problem, either, but that's an unrelated issue.
This issue is causing the mail server to be blacklisted with, for example, spamhaus.org. Since I can't find the infected windows host, I hit upon the idea of using IP aliasing to send the NAT traffic out through a different IP address.
eth0: 18.104.22.168 eth0:1 22.214.171.124
In my firewall rules I then changed
iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to 126.96.36.199
iptables -t nat -A POSTROUTING -s 172.18.90.0/24 -o eth0 -j SNAT --to 188.8.131.52
The problem is now everything appears to be going out as 184.108.40.206, including traffic from the mail server. If I ssh from the firewall host to another external machine, the connection is identified as coming from 220.127.116.11.
This doesn't make sense to me as I'm specifically specifying the source IP's which are supposed to be NATed. Originally I tried the line above without "-s 172.18.90.0/24" and got exactly the same result.
Any thoughts on what is going on? I'm not an iptables expert by stretch of the imagination, but have made an effort to try and research this before posting to serverfault.
root@www:etc# ip ro 18.104.22.168/24 dev eth0 proto kernel scope link src 22.214.171.124 126.96.36.199/24 dev eth0 proto kernel scope link src 188.8.131.52 172.18.90.0/24 dev eth1 proto kernel scope link src 172.18.90.1 default via 184.108.40.206 dev eth0 src 220.127.116.11 metric 100 default via 18.104.22.168 dev eth0 metric 100