0

I am trying to set up a system to do NAT and other iptables-stuff (like logging, firewall, monitoring, etc.). The ISP provides a dynamic IP address and the DSL modem does NAT.

I have the following "small-business" configuration:

    192.168.1.1           |-----------|
    ----------------------|           |
                          |  SWITCH 1 |
    192.168.1.2           |           |
    ----------------------|           |
                          |           |
    192.168.1.3           |           |
    ----------------------|           |
                          |-----------|
                               |
                               | 192.168.1.4
                               |
                         |--------------|
                         | Dual NIC     |
                         | IPTABLES m/c | NAT
                         |--------------|
                               |
                               |
                               |192.168.2.2
                               |
                         |--------------| 192.168.2.1 |----------------|
                         |  SWITCH 2    | ------------|DSL Modem NAT   |
                         |--------------|             |----------------|

My goals are to control what each node on 192.168.1.x LAN can do, log entries, etc. The IPTABLES machine will be doing a lot more than what the Iptables CLI can... Some C interface to the libnetfilter_queue library is expected as we need to do some custom monitoring and logging.

I do not have a static Public IP address. So, I need to depend on the NAT built in the DSL. Effectively I will end up with two NATs in series. One SNAT through IPTables with source changed to 192.168.2.2. The second is the one that the DSL modem will do to change source IP from 192.168.2.2 to whatever is the public Internet IP assigned at the time.

I think that there must be a better approach. What is it? Or am I totally offtrack?

2
  • 1
    There's no reason to double NAT. Just route normally. Apr 26, 2015 at 18:59
  • @MichaelHampton So if I just enable forwarding on my IPTables m/c and set default gw on that to 192.168.2.2, all should work fine without any IPTABLES rules? I tried that. It does not work. If I try to ping from 192.168.1.1 to an outside IP, it fails.
    – Sunny
    Apr 27, 2015 at 12:38

0

You must log in to answer this question.

Browse other questions tagged .