Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there any way to forward packets from network A to network B (just like a router) without changing source IP Address (and vice versa, from network B to network A) and also enforcing traffic shaping rules?

The solution should be implemented in FreeBSD.

I googled about traffic shaping in FreeBSD and found ALTQ but i am not sure whether it is possible to forwards packets with ALTQ transparently or not.

If it's possible then it's likely that i could setup a network with a Squid server (for caching and more imporant logging user's download/upload) and ALTQ (or something else) to manage their bandwidth. So my network architecture will be:

Internet <==> SquidServer <==> TrafficshapingServer <==> LocalNetwork

But if TrafficShaping replaces SourceIP of packets with his IP Address, logs of Squid becomes useless. because Squid didn't know which packet is from which IP Address (all Squid see is TrafficShaping IPAddress)

share|improve this question
up vote 3 down vote accepted

Sure, routers don't ordinarily change source/destination IP addresses; only NATting routers do that. So, just don't use NAT, and all will work fine.

share|improve this answer
So it is possible routeing without NATing in ALTQ? – Isaac Nov 17 '09 at 15:49
I'd be surprised if it couldn't be. – womble Nov 17 '09 at 16:06

I'm not familiar with it, but I'd be wiling to bet that the TrafficShaper you're referring to is NAT'ing primarily to guarantee that traffic returns via the correct path. Otherwise you're likely to end up with an asynchronous routing problem, which will cause failure.

One thing you might want to look into is inserting an X-Forwarded-For header at the squid server. This is actually a little more reliable method of tracking source in a proxy'ing environment as it inserts the data into the actual data instead of relying on IP header information.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.