I have a separate namespace running on my server and I want to create a NAT that will enable Internet connectivity in this namespace. I specifically want to do this so that certain inbound ports are destined for the main server and certain others for the namespace. Both the namespace and the main server should have outbound connectivity. To achieve this, I have created a virtual Ethernet with one end in the main server and one end in the namespace (this part seems to work judging by packet counters).
After enabling IP forwarding in sysctl.conf, here is what I came up with to forward traffic between them (this doesn't work):
iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source <IP of main server> iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 1:25000 -m conntrack --ctstate NEW -j DNAT --to-destination <IP of veth inside namespace> iptables -t nat -A PREROUTING -i eth0 -p udp --dport 1:65534 -m conntrack --ctstate NEW -j DNAT --to-destination <IP of veth inside namespace>
Could someone let me know what I'm doing wrong with IPtables?