Preserving source IP behind double-NAT network

Question

I have a network scenario where double NAT-forwarding is happening.
Public Firewall and Internal Firewall are doing NAT forwarding. I have only control of the Internal Firewall.

Client: X.X.X.X
Public Firewall: 10.10.10.1
Internal Firewall: 192.168.1.10
SSH server: 192.168.1.20

Public Firewall: Forwards all ports to Internal Firewall
Internal Firewall: Configured to forward port 22 to SSH Server

My problem is when Client connects to port 22 through the Public Firewall i see the ip of the Internal Firewall (192.168.1.10) on the SSH server instead of the Client's IP

This is how iptables are configured on the Internal Firewall:

iptables -A PREROUTING -t nat -p tcp -d 192.168.1.10 --dport 22 -j DNAT --to-destination 192.168.1.20:22

iptables -A POSTROUTING -t nat -p tcp -d 192.168.1.20 --dport 22 -j SNAT --to-source 192.168.1.10

Is there a way of preserving the Client's IP when it reaches SSH server ?

Answer 1

You should be able to preserve the client IP if you remove the SNAT on Internal Firewall, and if all systems have the appropriate routes to reach the destination IPs in packets they are sending.

This likely means that SSH Server needs to use Internal Firewall as its default gateway. You might need to do an SNAT back the other way, so the SSH Server's source IP is changed to the Internal Firewall's source IP when traffic is on that way back to the client. That depends on the Public Firewall.

If traffic mysteriously disappears at the SSH Server, try to log martian packets (net.ipv4.conf.all.log_martians) and/or temporarily turn off the Reverse Path Filter (net.ipv4.conf.all.rp_filter). Get things working simple and add complexity like RPF later.

When troubleshooting, packet capture on specific interfaces (tcpdump -i netX) and not on all interfaces (tcpdump -i any) so you can see exactly where traffic is coming to and going from.

If you can't set the Internal Firewall as the default gateway, you could also do this with policy routing on the SSH Server, but policy routing is pretty awful. Not recommended.

There isn't enough information about the rest of the network to provide a definite answer, but yes what you want is technically possible.