I have a WAN router which is linked to isp over a /30 WAN subnet. But it also servers as a router to a /29 local public WAN subnet which is connected to few of my servers. The traffic from /29 gets routed to ISP via /30 subnet. For a wired reason I want to masqarade (NAT) the interface which has /30 ip. So the interface with /30 ip should appear as masquaraded for my network and it also should act as a normal non-NAT router for my WAN public subnet /29. Can this be done with iptables on a Linux machine?

EDIT1: How my firewall rules are at present:

iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X

iptables -P INPUT ACCEPT

#WAN Security
iptables -A INPUT -d -m state --state INVALID -j DROP
iptables -A INPUT -d -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -t nat -A POSTROUTING -s -o eth0 -j SNAT --to-source

iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT

iptables -A INPUT -d -j DROP

Yes, this will work just fine. Set up your packet filtering and your routing just like you would if you weren't using any NAT at all and then add something like:

iptables -t nat -A POSTROUTING -s -o eth0 -j SNAT --to-source

(Assuming that your ISP is connected to eth0, and your public IP is

This will apply the NAT only to packets coming from your LAN with private IP addresses.

  • How would I filter ports on (firewall), without affecting my /29 subnet? – nixnotwin Nov 26 '11 at 17:28
  • 1
    Use the -d flag of iptables to filter traffic destined only for – Per von Zweigbergk Nov 26 '11 at 18:29
  • I have only two interfaces. So eth0 will be So can I have other one like this: eth1 and eth1:0 as – nixnotwin Nov 29 '11 at 14:26
  • There's no reason I can think of that wouldn't work. But in general I'd recommend against having multiple IP subnets on a single Ethernet network. Even if you have only two physical interfaces on the router, you can still use VLANs to partition your Ethernet network. – Per von Zweigbergk Nov 30 '11 at 2:31
  • I have updated my question with my final iptables rules. Any suggestions or advice? – nixnotwin Nov 30 '11 at 5:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.