0

I am trying to implement a 1 to 1 NAT on a Linux Box. The setup is pretty basic, it has two interfaces, eth0 is the outside interface, eth1 is the inside. Behind eth1 resides the isolated 192.168.100.0/24 network while eth0 connects to the rest of the network on 192.168.0.0/24 (this network is irrelevant). What I want to do is allow the isolated network to communicate through the linux box using an external IP address of a different network, 192.168.50.0/24. So basically the linux box nats 192.168.100.10 from the inside network to 192.168.50.10 routed out of the linux box. I've set up routes to point traffic destined for 192.168.50.0/24 to the Linux box's eth0 interface on all external devices.

At this point, traffic destined for 192.168.50.0/24 arrives at eth0 of the Linux box, but it never seems to translate over as I never see any traffic for either 192.168.50.10 or 192.168.100.10 on the internal eth1 interface. Below is my basic NAT config. My question is, do I need to do something else? I didn't bother adding routes on the Linux box for the 192.168.50.0/24 network since the box never routes packets with that address due to this NAT config.

Outbound rule

-A POSTROUTING -o eth0 -s 192.168.100.10 -j SNAT --to-source 192.168.50.10

Inbound rule

-A PREROUTING -i eth0 -d 192.168.50.10 -j DNAT --to-destination 192.168.100.10

Temp rules to allow all traffic

-A INPUT -j ACCEPT
-A FORWARD -j ACCEPT

Notice all other traffic is allowed through iptables as well by default, so it shouldn't be a blocking issue.

2 Answers 2

2

You need to confirm you have the following conditions met:

  1. Enable the IP forwarding using: echo 1 > /proc/sys/net/ipv4/ip_forward or by setting the appropriate line in /etc/sysctl.conf.
  2. Allow the traffic to pass through the box which should be OK according to your description.
  3. Setup the needed NAT rules which should be OK according to your description.
  4. Setup the needed routes (static or dynamic) if the routed IPs belong to subnets not directly connected to the Linux router. This should be also OK according to your description.

It seems that you are left with the first point!

1
  • As soon as you listed #1, I knew that was the problem. I got bit by that on an OpenVPN install and completely forgot about that setting. Sure enough, flipping that on fixed the issue, thank you very much for providing that information.
    – Brandon
    Dec 7, 2011 at 23:17
1

It may be an ARP issue. See the Shorewall One-to-one Nat notes. I tend to prefer a firewall builder tool like Shorewall for things like this.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .