up vote 0 down vote favorite
1
share [g+] share [fb]

I am new to iptables and NAT. But I am working on it through various material both in online and books. I have a doubt regarding NAT implementation using iptables.

Let us suppose my network scenario is as shown below.

                  linuxbox2 (10.0.0.3)
                    |
                    |
linuxbox1-------- Switch ----- INTERNET
(10.0.0.2)        (194.160.1.1)

My Linux boxes 1 & 2 connect to the internet via switch and I have only one Public IP-Address(194.160.1.1). But the communication is a bit strange. box2 does not connect directly to outerworld via switch. But it is in vlan with box1. Hence traffice from box2 goes to box1 then travels down to switch to connect to outer world. We does natting at box1

Since we try to masquerade to the same public ip-address what should be the rules in iptable.

My question might be strange but I am not able to explain it clealry ...

Started a new thread with more details and outputs at

http://serverfault.com/questions/78237/iptables-and-snat

link|improve this question
25% accept rate
I don't understand your question. Why do you want to "differentiate the traffic originating from box 2 and 3 using nat table in box 1"? "what should be the rules in iptable which helps box1 in pre-routing the traffic to exact box" > it's taken care of automatically by netfilter which keeps track of which connections belongs to who. – e-t172 Oct 8 '09 at 8:32
Sorry folks I have done complete re-write of the question .... I am not sure if it is complete ... I might be updating even with more precise information once I am clear with my mind – codingfreak Oct 8 '09 at 8:55
feedback

migrated from stackoverflow.com Oct 8 '09 at 8:23

This question came from our site for professional and enthusiast programmers.

2 Answers

up vote 1 down vote accepted

If I understand your question well, Box 2 is in a VLAN with Box 1, and Box 1 is in another VLAN as well which has access to the Internet.

Assuming the first VLAN is e.g. VLAN 100 and the second VLAN is VLAN 200, I assume you configured VLANs correctly on Box 1 and thus you have two network interfaces for the two VLANs (typically eth0.100 and eth0.200).

In this case the solution is simple, on Box 1:

iptables -t nat -A POSTROUTING -o eth0.200 -j MASQUERADE

With this command Box 1 will NAT-masquerade packets to the Internet on VLAN 200. Thus when Box 2 will send packets to Box 1 on VLAN 100, Box 1 will forward them to VLAN 200.

Make sure IP forwarding is enabled on Box 1 (sysctl -w net.ipv4.ip_forward=1).

link|improve this answer
@e-t172 I am very much thankful to u ... – codingfreak Oct 8 '09 at 9:31
One doubt ... When BOX2 and BOX1 try to do FTP to the same FTP server on INTERNET then how does the FTP server on internet differentiate BOX1 and BOX2 ... with the iptables rule which u have given for all the packets from both BOX1 and BOX2 we do POSTROUTING .. is that one rule enough ??? .. what about incoming packets destined to BOX1 and BOX2?? – codingfreak Oct 8 '09 at 9:38
You just need the POSTROUTING rule. Netfilter will handle incoming packets automatically thanks to connection tracking. – e-t172 Oct 8 '09 at 9:39
"how does the FTP server on internet differentiate BOX1 and BOX2" It doesn't. The two boxes have the same public IP address, so the external server can't differentiate between the two, that's the whole point of masquerading. Box 1 takes care of which packets goes to which box. – e-t172 Oct 8 '09 at 9:41
@e-t172 can I have the same nat based rule just with the IP-Addresses I have given. These private ip-addresses are permanent but there is a chance of change in VLANS .... so is there any another where I can set a nat rule just through ipaddresses ?? – codingfreak Oct 8 '09 at 9:57
show 16 more comments
feedback
up vote 0 down vote

http://www.revsys.com/writings/quicktips/nat.html

link|improve this answer
Your answer doesn't solve my problem DmitryK – codingfreak Oct 8 '09 at 8:28
Yes it does. If it doesn't you should add details to your question. – e-t172 Oct 8 '09 at 8:33
But I dont want to set the rules based on the NETWORK interface ... – codingfreak Oct 8 '09 at 8:35
Sorry, but you're just not making any sense. If you want to do masquerading NAT you have to set your rules according to the internal interface and the external interface. If you don't, well, that just isn't gonna work. But again I have no idea what you're asking for. Maybe you should tell us what you're trying to achieve at the end. – e-t172 Oct 8 '09 at 8:37
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.