I am having problems redirecting incoming traffic to 2 external facing interfaces on my Ubuntu 12.10 server to 2 separate internal hosts. I am able to redirect incoming traffic on my eth0 just fine to the internal host but the incoming traffic to my eth1 interface never goes anywhere.

Any suggestions?

Here are the iptables and interfaces settings I am using.

/etc/iptables.rules
-A PREROUTING -i eth0 -p tcp -m tcp --dport 8000 -j DNAT --to-destination 10.101.0.20:3389
-A PREROUTING -i eth1 -p tcp -m tcp --dport 3389 -j DNAT --to-destination 10.101.0.79:3389
-A POSTROUTING -o eth0 -j SNAT --to-source 63.22.130.186
-A POSTROUTING -o eth1 -j SNAT --to-source 63.22.130.187


/etc/network/interfaces
# eth0
auto eth0
allow-hotplug eth0
iface eth0 inet static
      address 63.22.130.186
      netmask 255.255.255.248
      gateway 63.22.130.185
      dns-nameservers 8.8.8.8
      pre-up iptables-restore < /etc/iptables.rules

# eth1
auto eth1
allow-hotplug eth1
iface eth1 inet static
      address 63.22.130.187
      netmask 255.255.255.248
      dns-nameservers 8.8.8.8

# eth2
auto eth2
allow-hotplug eth2
iface eth2 inet static
      address 10.101.0.1
      netmask 255.255.0.0
      dns-nameservers 8.8.8.8
share|improve this question
    
eth0 and eth1 both have an IP in the same network. You might as well add the IP of eth1 as a secondary IP of eth0. – Zabuzzman May 1 '13 at 19:06
    
Hmmm... I need to choose which internal host to direct traffic to based on the external IP address it came from. Can I do that with multiple IPs on the same interface? – user127875 May 1 '13 at 21:10
    
Yes, see answer. – Zabuzzman May 1 '13 at 21:45

The problem is with the -o statement in the POSTROUTING chaine:

 -A POSTROUTING -o eth0 -j SNAT --to-source 63.22.130.186
 -A POSTROUTING -o eth1 -j SNAT --to-source 63.22.130.187

The packets will be routed to hosts in the 10.101/16 network, thus you would need -o eth2.

Why not try something like:

-A PREROUTING -p tcp -m tcp -d 63.22.130.186 --dport 8000 -j DNAT --to-destination 10.101.0.20:3389
-A PREROUTING -p tcp -m tcp -d 63.22.130.187 --dport 3389 -j DNAT --to-destination 10.101.0.79:3389

And put the IP of eth1 as a secondary of eth0

share|improve this answer
    
Are you suggesting I just add one more line to the POSTROUTING chain, or should I delete the existing lines too? Here is the line I think you are suggesting I add: -A POSTROUTING -o eth2 -j SNAT --to-source 10.101.0.1 – user127875 May 1 '13 at 20:38
    
I updated the answer with a possible solution. – Zabuzzman May 1 '13 at 21:44

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.