Questions tagged [nat]
In computer networking, network address translation (NAT) is the process of modifying network address information in datagram (IP) packet headers while in transit across a traffic routing device for the purpose of remapping one IP address space into another.
2,032
questions
1
vote
1
answer
2k
views
Exposing an internal IP to the internet on GCP
Be warned, noob question here.
I want to play around with GCP AlloyDB. I have created a cluster and it has been assigned an internal IP. This is fine for applications running in the same VPC/ project ...
1
vote
1
answer
698
views
IP forwarding with IPTables for lvs nat mode
I am learning about the L3 loadbalancers and now working on the keepalived NAT mode.The packet flow should be Client ------> L3(lvs DNAT)------> real servers and the return flow should be exact ...
1
vote
0
answers
124
views
ECS task to VPC endpoint/NAT Gateway routing
we have an ECS task that makes Rest API calls of two types: /path1 and /path2 in a Private subnet. We route the requests to Internet Gateway through a NAT gateway present in a public subnet.
Flow: ECS ...
-1
votes
1
answer
181
views
VPN overlapping with network that provides access to internet
I have computer which is connected to Network A with ip range 10.0.0.0/24.
This network provides access to internet and that's the only thing I need from Network A.
My comporate VPN (Network B) using ...
1
vote
1
answer
593
views
Properly configuring iptables for two layers of port forwarding: external server connected to local server via VPN
I had a minecraft server running on a VPS (Debian 10), but the VPS was too puny to handle it so I wanted to use a beefier local server to run it (Ubuntu 22.04). The VPS is hosting an OpenVPN server, ...
0
votes
0
answers
141
views
NAT port to internal node
We are working with a PLC (phoenix plc next) which connects to a profinet (and profibus) network. Due to lack of tooling and being unable to rewire things to our needs (the PLC is integrated in our ...
1
vote
2
answers
952
views
Why is my Azure VPN Gateway-NAT rule not working?
I have a very simple scenario, Azure Vnet with a subnets 10.140.1.0/24 (GatewaySubnet, SKU=Gw2 gen1) and 10.140.10.0/24 (VirtualMachineSubnet). Then an OnPrem network with 10.190.0.0/16.
I have a ...
1
vote
0
answers
2k
views
Redirecting traffic to a bridged ip and port using PF on MacOS
I am trying to redirect localhost traffic on specific port to bridged network ip
I am using following
echo "
rdr pass inet proto tcp from any to any port 9300 -> 192.168.64.29 port 9300
rdr ...
2
votes
1
answer
751
views
How is CGNAT routed on the client?
When testing a Zscaler POC (from a security perspective), I had a hard time understanding how CGNAT is routed on the client.
My main concern (and question) is that the 100.64.x.y route is not in the ...
0
votes
1
answer
559
views
What does exactly break with double NAT?
There are many warnings about double NAT networks.
DSL---modem with router-----second router
configured by ISP inner network
first NAT second NAT
What will exactly break ...
0
votes
1
answer
63
views
Debian Redirect Single Port of Outbound Connection
I have a Debian 11 VM on a Windows machine. It has 3 network adapters. One is external (WAN), one internal (LAN) and another private (experimental).
I am using the box as a router which in turn uses ...
3
votes
1
answer
4k
views
Wireguard forward traffic to host
I'm using Wireguard as docker container on a pi. I'm running a couple other services on the pi that I want to be only accessible over the wireguard connection. The wireguard server created an ...
0
votes
0
answers
64
views
iptables loses source address when forwarding to an internal virtual machine (Proxmox)
I have a Proxmox hypervisor. This proxmox is running a VM with HAProxy load balancer.
I am now trying to forward to this HAProxy via iptables port 80 and 443. Unfortunately the source address is lost ...
0
votes
0
answers
644
views
How to use aggressive mode + transport mode + PSK to negotiate SAs with strongswan server in NAT-T environment
I used the transport mode and NAT-T environment to negotiate SAs, and the method to authenticate the peer is PSK.
When I use Main Mode, IKE negotiation can be completed normally, the logs of PSK is:
...
0
votes
0
answers
147
views
can't get iptables to handle more than 1.5 million nat sessions
I am trying to see how many NAT sessions I can handle in a single linux machine using iptables. I am testing it using a large number of udp packets but I can't seem to pass 1.5 million. I set net....
0
votes
0
answers
178
views
How to health check a distributed NAT gateway?
I am using Google Cloud Platform and have manually setup a NAT gateway to peer two networks A and B so that workloads in network A have a default gateway which routes packets into network B. The ...
0
votes
1
answer
56
views
Does NAT leave a trace of the internal source?
I was wondering if there is any trace left of the original source when a packet leaves NAT.
Let’s say I do a series of DNS requests from my machine to a public server. I’m behind NAT. Can the server ...
1
vote
0
answers
275
views
How to bind an external IP address to a new NetNat network?
On my Hyper-V 2019 server, which is joined to the domain that's hosted on one of its VMs, I'm running on the 192.168.0.0/24 subnet. I'm setting up a demo of a new DC for a customer, so I need it to ...
0
votes
1
answer
229
views
Is it OK, to use iptables SNAT rule with inverted -o parameter?
Would it be OK/reliable, to use just one rule?:
iptables -t nat -I POSTROUTING ! -o eth2 -s 192.168.10.0/24 -j SNAT --to PUBLIC_IP_ADDRESS
The BGP linux router has 25 ethernet interfaces. This ...
1
vote
1
answer
789
views
What is UDP Masquerading behavior when forwarding and listening on the same port to the same remote address?
Assuming the following:
||netns2|<-kernel routing-> netnsRoot| <-network routing-> |remote server|
netns2
is a network namespace
has a client that connects to the UDP server on UDP/5060
...
1
vote
1
answer
2k
views
Iptables Port-forwarding while preserving client IP
TL;DR: How can I get the client ip connecting to a remotely hosted VPS to be the IP that gets forwarded/natted, via iptables, to a game server running at my house?
I have a Rust game server that I am ...
0
votes
1
answer
491
views
Destination NAT onto the Same Network in AWS using IPTables
In AWS we have 3 instances in the same subnet/VPC. We would like to have the client instance make a DNS request to a second analysis instance, which will then forward the request to a third instance ...
0
votes
1
answer
249
views
How to proxy ftp connection between IPV4 server to an IPV6 client and vice versa
We have a gateway solution which connects legacy RADIO's having ftp server running with IPV4 interface to DU's running with IPV4 ftp clients to do file upload and download operations.
And currently we ...
0
votes
0
answers
127
views
Debian with 2 ethernet as VPN relay (route all traffic from eth0 to eth1 VPN)
Background
I got 2 Debian VMs, first one is pptp/wireguard server on WAN 10.10.0.1 and second one's eth0 192.168.100.1, eth1 172.16.100.1.
Note: WAN IPs written in private ranges Intentionally
...
0
votes
1
answer
771
views
Should I do the stateful matching with iptables for nat table?
I often see that there are some stateful matching rules in a iptables' chain such as INPUT.
I known what they are doing, and I'm interested in that
Should I do the same for the chains of the table ...
3
votes
2
answers
10k
views
Why does everybody use MASQUERADE/SNAT instead of NAPT/PAT?
Story
I have a VPN wireguard virtual interface wg0 (can be anything else) and a physical interface eth0. I want to route packets from the VPN to my LAN, or from an interface to another interface.
...
0
votes
1
answer
369
views
Two clients behind NAT on a single VPN connection, exting on two separate public IPs
I am looking for a way to forward outgoing traffic on separate IPv4 addresses for different clients connected through the same VPN tunnel, behind NAT.
Right now I am forwarding port 44158 from ...
0
votes
0
answers
285
views
Iptables hitcount instantly blocks ssh
Need some help with iptables. I always use to have vps with public ipv4 ip and used these rules in iptables to block ssh connections that tried to connect too many times.
-A INPUT -p tcp -m tcp --...
0
votes
0
answers
188
views
How to share VPN network access
I have got this setup with two LANs and OpenVPN infra.
I need to share the OpenVPN connection attached to Proxmox server (10.8.0.12) to the Proxmox VMs (192.168.0,1,2,3,...).
I was trying to use linux ...
0
votes
0
answers
191
views
Does AWS Educate allow the creation of NAT gateways?
I am trying to have quick access to the internet from a private subnet. I get this error message when creating a NAT gateway:
There was an error creating your NAT gateway
You are not authorized to ...
2
votes
2
answers
239
views
load balancing over single NIC to overcome per-connection limit
I have a strange setup where the ISP provides a very fast connection (10 Gbps) but limits each connection to 50 Mbps. This is fine for multi-threaded applications where I can just boost the number of ...
2
votes
0
answers
711
views
MetalLB on a host with multiple NIC
I need help with some deeper networking stuff. Hopefully somebody can help me or at least push me to the right direction.
At the moment I have a two node bare metal (VPS) kubernetes cluster setup with ...
0
votes
1
answer
296
views
How do I redirect URL while also changing source and destination IP address over HTTPS?
I have a SaaS service which exposes an URL (let's say (https://mylink.foo.com) that is only accessible from some whitelisted IPs. However we now need the aforementioned URL to be accessed by an ...
0
votes
1
answer
66
views
Would getting an Access Point potentially help fix my NAT? [closed]
Not too long ago we switched internet providers to T-Mobile Home Internet and the speed has been a huge improvement, but recently a problem has risen to my attention of the NAT type on my family's ...
0
votes
1
answer
1k
views
SSH over Mikrotik NAT fails
I have a server on my network which I want to expose to external SSH connections. I can ssh directly to the device from my network (e.g. ssh 192.168.88.162 works fine). I have a NAT rule set up so ...
1
vote
1
answer
5k
views
iptables NAT REDIRECT
I have a server that is receiving syslog traffic. Many of my devices can only send to the default udp/514 port. My syslog server can't run on ports <1024 and is running on 5000. I have a nat ...
0
votes
0
answers
1k
views
Unable to SSH into my proxmox hypervisor from a VM
to start, here is my infra in summary :
I have a Proxmox server with an IP public, I created a vmbr1 bridge from Proxmox (192.168.0.1) and I use IP 192.168.0.108 for my VM.
Here is the route : 192.168....
3
votes
3
answers
2k
views
GCP - why cloud NAT needs cloud router?
Why GCP Cloud NAT needs BGP/Cloud Router?
Cloud Router documentation
Cloud Router enables you to dynamically exchange routes between your Virtual Private Cloud (VPC) and on-premises networks by ...
0
votes
1
answer
672
views
Issue with TFTP and IPTables and (s)-NAT
I've some issues with TFTP download behind NAT using IPtables and i could really use your help. I'm familiar with networking pricipals, but pretty new to IPtables, so i'm sorry if i'm doing something ...
1
vote
1
answer
2k
views
pfSense NAT to server in a second LAN subnet behind an internal second router (not working)
I have a pfSense firewall/router that is exposing some services to my public ip.
This is working fine, as long as the service is on the primary LAN subnet (192.168.1.0/24), let's call it LAN-A.
E.g. ...
1
vote
0
answers
308
views
How can I configure Wireguard running in a docker container on a VPS to allow communication between its' connected clients?
I have a VPS running WireGuard as a server in a docker container, where I've given it the devices I intend on adding as peers.
I have a home server running WireGuard as a client in a docker container ...
1
vote
2
answers
566
views
Flushing IP table doesn’t flush NAT
When I execute sudo iptables -F,my iptable rules for the nat table are not flushed. Why is this the case? What does the above command do?
I believe there are three tables: filter, nat, and mangle. I ...
0
votes
0
answers
591
views
MikroTik - configure NAT behind NAT
I have primary Mikrotik router connected to Internet provider and serving internal network 192.168.88.0/24. I also have second Mikrotik router which I want to plug into my internal network of the ...
0
votes
1
answer
35
views
How to toubleshoot port blocking issue
I'm forwarding port 80 of a web server to the public interface of the firewall, which is then mapped to a domain name so that the server can be accessible from that domain name.
I did this process too ...
0
votes
1
answer
209
views
FreeBSD: How can I tune the lifetime for TCP/UDP for in kernel NAT?
There used to be these sysctls in older versions of FreeBSD, viz:
net.inet.ip.fw.dyn_ack_lifetime=3600
net.inet.ip.fw.dyn_udp_lifetime=15
now on FreeBSD 12 sysctl reports that these don't exist.
How ...
0
votes
0
answers
31
views
how can I NAT a NAT IP
I have a server on AWS with a floating (secondary) IP. During integrations with a partner I provide my secondary IP to be whitelisted and define a POSTROUTING rule to SNAT my IP to the secondary IP ...
12
votes
4
answers
8k
views
What happens if two local systems download the same resource on same port?
I'm aware of NAT table. I just want to know what happens if two clients in a private local area network want to download exactly the same resource on the same port? In other words , When a packet ...
1
vote
2
answers
378
views
Choice of NAT64 prefix
I'm about to deploy NAT64 and I noticed that it's possible to use your own prefix instead of the "well-known prefix". Now I can imagine complex scenarios with multiple NAT64 gateways serving ...
0
votes
1
answer
2k
views
NAT64 on Debian
Update 2: I wrote a quick&dirty tutorial for Jool on Debian 11, since their website is very thorough, but also slightly confusing and the examples too complex for most cases.
I'm looking to go ...
0
votes
3
answers
1k
views
How to prevent netfilter to automatically change the source ports
I observed that netfilter changes the source port when a connection is established in the conntrack module. I need to prevent this behavior.
Here is what I have done to reproduce my problem:
I create ...