1

I have a WAN router which is linked to isp over a /30 WAN subnet. But it also servers as a router to a /29 local public WAN subnet which is connected to few of my servers. The traffic from /29 gets routed to ISP via /30 subnet. For a wired reason I want to masqarade (NAT) the interface which has /30 ip. So the interface with /30 ip should appear as masquaraded for my 192.168.1.0/24 network and it also should act as a normal non-NAT router for my WAN public subnet /29. Can this be done with iptables on a Linux machine?

EDIT1: How my firewall rules are at present:

iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X

iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT

#WAN Security
iptables -A INPUT -d 1.2.3.3 -m state --state INVALID -j DROP
iptables -A INPUT -d 1.2.3.3 -m state --state ESTABLISHED,RELATED -j ACCEPT

#NAT
iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth0 -j SNAT --to-source 1.2.3.3

#FORWARD
iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT


iptables -A INPUT -d 1.2.3.3 -j DROP
Improve this question

1 Answer 1

Reset to default
2

Yes, this will work just fine. Set up your packet filtering and your routing just like you would if you weren't using any NAT at all and then add something like:

iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth0 -j SNAT --to-source 1.2.3.3

(Assuming that your ISP is connected to eth0, and your public IP is 1.2.3.3.)

This will apply the NAT only to packets coming from your LAN with private IP addresses.

Improve this answer
5
  • How would I filter ports on 1.2.3.3 (firewall), without affecting my /29 subnet?
    – nixnotwin
    Nov 26, 2011 at 17:28
  • 1
    Use the -d flag of iptables to filter traffic destined only for 1.2.3.3.
    – Per von Zweigbergk
    Nov 26, 2011 at 18:29
  • I have only two interfaces. So eth0 will be 1.2.3.3/30. So can I have other one like this: eth1 192.168.1.1/24 and eth1:0 as 1.2.4.77/29?
    – nixnotwin
    Nov 29, 2011 at 14:26
  • There's no reason I can think of that wouldn't work. But in general I'd recommend against having multiple IP subnets on a single Ethernet network. Even if you have only two physical interfaces on the router, you can still use VLANs to partition your Ethernet network.
    – Per von Zweigbergk
    Nov 30, 2011 at 2:31
  • I have updated my question with my final iptables rules. Any suggestions or advice?
    – nixnotwin
    Nov 30, 2011 at 5:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .