2

So I have a machine with a single interface. It has 2 ip addresses (eth0: 192.168.2.3, eth0:1 192.168.2.4). I'd like to take any traffic coming in on 192.168.2.4 and NAT it to an external ip address. As best I can tell I've done everything needed to make it work, but it doesn't so I'm missing something.

/proc/sys/net/ipv4/ip_forward is set to 1

my iptables are all set to default ACCEPT, here is my DNAT rule:

iptables -t nat -A PREROUTING -d 192.168.2.4 -j DNAT --to-destination 192.1.1.2

The machine has a route to 192.1.1.2 via a gateway reachable from eth0: 192.1.1.2 192.168.2.248 255.255.255.0 UG 0 0 0 eth0

The DNAT rule doesn't seem to actually be doing any sort of NAT/redirection.

What have I missed?

1
  • For anyone else that runs across this, I was missing the corresponding SNAT rule. Once I put that in place, it worked like magic ;). iptables -t nat -A POSTROUTING -d 192.1.1.2 -j SNAT --to-source 192.168.2.4
    – koyong
    Sep 19, 2011 at 18:42

1 Answer 1

1

I'd do an iptables -t nat -L -v -n to see the counts on the DNAT rule in the PREROUTING chain. You can watch them increase with each new connection processed by the rule. If they're not being incremented then I'd start sniffing the traffic on the eth1 interface to see if the traffic is making it there.

It's likely that your FORWARD chain is set to a default drop policy and doesn't have a rule to forward this traffic. Double-check that, too.

1
  • All of my tables are definitely set to default allow, it seems as though iptables isn't liking my alias interface at all. I changed the NAT rule slightly so that instead of -d I was checking --dport 22 and the counts were moving, but it was also intercepting my traffic on the actual interface (which won't work).
    – koyong
    Sep 19, 2011 at 16:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .