3

I'm trying to setup a linux box as router and I'm a little confused on how the following rules will affect the packets.

e.g. In routing table I can have 

default via 10.10.1.1 dev eth0 src 192.168.1.1

which changes the source IP address of the packet to 192.168.1.1

And in iptables, I can have 

-A POSTROUTING -s 192.168.0.0/255.255.0.0 -o eth0 -j SNAT --to 192.168.1.1

Which also seems to ask next hop that return packet should go to 192.168.1.1

So what's the difference?

Improve this question
7

The first one selects the source IP address when a packet is originated on this machine and the source IP address isn't compelled by any other factor. That is, when the system has to choose source addresses, this defines its choice.

The second one changes the source IP address of an already-existing packet that is being routed.

One affects packet generation the other affects packet forwarding.

Improve this answer
4
  • Good answer. But in what scenario would a system have to choose source addresses for an originating packet? – Karma Fusebox Feb 27 '13 at 22:35
  • Any time traffic originates on this machine and the software that originates the traffic doesn't choose the source address, which is most of the time. So when you make a local outbound TCP connection or send a local outbound UDP datagram, typically the kernel chooses the source address. – David Schwartz Feb 27 '13 at 22:41
  • 1
    There is usually not much need for forcing the source address. Doing it on a default route makes less sense. Cases I would think of would invoke specific destinations where the default source address could be confusing because of more than one network numbered alike. But one possibility is a host than can access the internet via 2 or more different ISPs each with different private IP pools. – Skaperen Feb 27 '13 at 22:48
  • 1
    @Skaperen: Another reason would be if you had redundant internal links. You want the source address to be a "neutral" IP address reachable over either link, not one assigned to either link that will fail if that link fails. – David Schwartz Feb 27 '13 at 22:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.