0

I am doing NAT traffic forwarding using iptables (1.1.1.1 => 2.2.2.2) with the following commands:

iptables -t nat -A PREROUTING -d 1.1.1.1 -j DNAT --to-destination 2.2.2.2
iptables -t nat -A POSTROUTING -d 2.2.2.2 -j SNAT --to 1.1.1.1

It works fine except for one thing: If I check apache logs, doing firewall rules etc. on server 2.2.2.2, it looks like all traffic is comming from 1.1.1.1.

Of course it makes a bit sense, since it is 1.1.1.1 that is forwarding the traffic to 2.2.2.2, but I assumed NAT would pass the original IP "requestor" in the package?

Is there a way to make the traffic to 2.2.2.2 have the "real" orignal IP?

Currently, it makes it very difficult to setup good firewall rules and other security stuff as ALL traffic seems to be comming from 1.1.1.1 regardless what the original traffic is actually comming from.

2
  • I did not understand your rules well. If you want to redirect the traffic destined to 1.1.1.1 to be destined to 2.2.2.2, the first rule should be enough. In this case, you will see the original requester IP address. Using both rules, you are changing both the source and destination addresses!!
    – Khaled
    Jul 16, 2013 at 10:43
  • Without the SNAT rule, traffic will never get back to the original client properly, so the DNAT by itself is insufficient.
    – John
    Jul 16, 2013 at 12:03

1 Answer 1

1

Apache will never see the IP behind the NAT. The endpoint system, 2.2.2.2, doesn't know about anything outside of 1.1.1.1. The only way to get the original requestor's IP is to embed some sort of javascript or client-side code that runs the equivalent of ipconfig or ifconfig on the client and hands that output off to the web server as part of a POST. This is generally frowned upon, however.

5
  • So you are basically saying that I cannot put any IP-based firewall rules on the 2.2.2.2 server, as it will see ALL incomming traffic as 1.1.1.1? Jul 16, 2013 at 12:20
  • No, I'm saying you cannot put any NAT rules in place. It amounts to the same thing in practice, but the "firewall" rules blocking access to certain ports are different from "NAT" rules telling packets where to go.
    – John
    Jul 16, 2013 at 12:24
  • After some digging around, this can not be true. Computers behind the NAT "router" should still see the requests comming in as from the original IP. Jul 16, 2013 at 12:31
  • Ok, so how would "reserve proxy" iptable rules looks like that accomplishes this? I know NAT is usually used for outgoing traffic and I am trying to forward incomming traffic instead. Incomming traffic to 1.1.1.1 should be forwarded to 2.2.2.2 and the response comming from 2.2.2.2 should, of course, be routed back to 1.1.1.1 Jul 16, 2013 at 12:34
  • 1
    What you want cannot be accomplished via iptables. A NAT router will always hide the external IP address. An outgoing NAT always hides internal addresses (e.g. a home network) and gives only the one public address you have from (as an example) AT&T to external web servers. That is how it works. Are there other, more complicated solutions that may give you what you want? I wouldn't be surprised. Are they worth the time to figure out? I don't think so.
    – John
    Jul 16, 2013 at 12:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .