0

I have a STUN service running on the same machine that is the gateway for the LAN, I would like the results from the STUN service be the same for both internal and external machines. Currently since the masquerading is done in the postrouting rule when the packets leave the gateway the STUN server will just see the LAN IP/port instead of the natted ip/port.

eth1 (lan): 10.0.0.1/32
eth0 (wan): 1.2.3.4/31
iptables -A POSTROUTING -t nat -o eth0 -j MASQUERADE 
iptables -A INPUT -p udp -d 1.2.3.4/31 --dport 3701 -j ACCEPT

When a LAN machine with IP 10.0.0.2 contacts the STUN service at 1.2.3.4 the packets get through but the STUN service see that the packet gets sent from 10.0.0.2.

How can I get the NAT translation to occur before the packet arrive to the STUN service and that the response back from the STUN service won't be from 10.0.0.1 but rather the 1.2.3.4 used when contacting the service?

Improve this question

1 Answer 1

Reset to default
0

Look at the image. Packets gets translated by MASQUERADE when they are to be routed. But your destionation host it the same host as router. So packet won't go through nat-POSTROUTING chain and won't be translated. They will go through filter table instead

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .