I'm trying to route some public and private IP addresses using Ubuntu Server 18.04 using iptables. Please note: I've changed the first bits of my IP Address for privacy, but kept it numerical for readability. I've also enabled all the proper prerequisites like setting
Here's my NIC configuration:
eno1 (private, internal network) IP: 10.0.0.1/8 enp12s0f0 (public, outgoing interface) IP: 22.214.171.124/0 GW: 126.96.36.199 enp12s0f1 (public, internal interface) IP: 188.8.131.52/24
Basically, enp12s0f0 is the interface connecting me to the provider.
The switch connected to enp12s0f1 will supply public IP addresses to equipment that needs them. For example, 184.108.40.206 set up as a web server, or 220.127.116.11 as a PBX server.
Finally, eno1 connects to the internal network (10.0.0.0/8) as a gateway, forwarding traffic out enp12s0f1.
Here's the configuration I've been using in /etc/rc.local:
myip=18.104.22.168 myoip=22.214.171.124 iptables --flush iptables --table nat --flush iptables --delete-chain iptables --table nat --delete-chain iptables -F iptables -X iptables -t nat -A POSTROUTING -o enp12s0f1 -j SNAT --to-source $myoip iptables -t nat -A POSTROUTING -o enp12s0f0 -j SNAT --to-source $myip #IP Routing iptables -A FORWARD -i enp12s0f1 -j ACCEPT iptables -t nat -A POSTROUTING -o eno1 -j SNAT --to-source $myoip
And the output of
ip route is:
default via 126.96.36.199 dev enp12s0f0 proto static 10.0.0.0/8 dev eno1 proto kernel scope link src 10.0.0.1 10.8.0.0/24 dev tun0 proto kernel scope link src 10.8.0.1 #<- NOTE: Part of my OpenVPN config 188.8.131.52/30 dev enp12s0f0 proto kernel scope link src 184.108.40.206 220.127.116.11/24 dev enp12s0f1 proto kernel scope link src 18.104.22.168
I've tried various different modifications to the configuration, and in some instances the public network works and traffic moves to the appropriate host, but then the internal network wont work at all. On other occasions, the internal network works, but it will not let any traffic through to the public internal network. I feel like it only wants to forward traffic to one of the interfaces, but I know it can do both. It seems to be just outside of reach. Pulling my hair out here! Please help :)