I have a WAN router which is linked to isp over a /30 WAN subnet. But it also servers as a router to a /29 local public WAN subnet which is connected to few of my servers. The traffic from /29 gets routed to ISP via /30 subnet. For a wired reason I want to masqarade (NAT) the interface which has /30 ip. So the interface with /30 ip should appear as masquaraded for my network and it also should act as a normal non-NAT router for my WAN public subnet /29. Can this be done with iptables on a Linux machine?

EDIT1: How my firewall rules are at present:

iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X

iptables -P INPUT ACCEPT

#WAN Security
iptables -A INPUT -d -m state --state INVALID -j DROP
iptables -A INPUT -d -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -t nat -A POSTROUTING -s -o eth0 -j SNAT --to-source

iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT

iptables -A INPUT -d -j DROP

1 Answer 1


Yes, this will work just fine. Set up your packet filtering and your routing just like you would if you weren't using any NAT at all and then add something like:

iptables -t nat -A POSTROUTING -s -o eth0 -j SNAT --to-source

(Assuming that your ISP is connected to eth0, and your public IP is

This will apply the NAT only to packets coming from your LAN with private IP addresses.

  • How would I filter ports on (firewall), without affecting my /29 subnet?
    – nixnotwin
    Nov 26, 2011 at 17:28
  • 1
    Use the -d flag of iptables to filter traffic destined only for Nov 26, 2011 at 18:29
  • I have only two interfaces. So eth0 will be So can I have other one like this: eth1 and eth1:0 as
    – nixnotwin
    Nov 29, 2011 at 14:26
  • There's no reason I can think of that wouldn't work. But in general I'd recommend against having multiple IP subnets on a single Ethernet network. Even if you have only two physical interfaces on the router, you can still use VLANs to partition your Ethernet network. Nov 30, 2011 at 2:31
  • I have updated my question with my final iptables rules. Any suggestions or advice?
    – nixnotwin
    Nov 30, 2011 at 5:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .