I have a separate namespace running on my server and I want to create a NAT that will enable Internet connectivity in this namespace. I specifically want to do this so that certain inbound ports are destined for the main server and certain others for the namespace. Both the namespace and the main server should have outbound connectivity. To achieve this, I have created a virtual Ethernet with one end in the main server and one end in the namespace (this part seems to work judging by packet counters).

After enabling IP forwarding in sysctl.conf, here is what I came up with to forward traffic between them (this doesn't work):

iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source <IP of main server>
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 1:25000 -m conntrack --ctstate NEW -j DNAT --to-destination <IP of veth inside namespace>
iptables -t nat -A PREROUTING -i eth0 -p udp --dport 1:65534 -m conntrack --ctstate NEW -j DNAT --to-destination <IP of veth inside namespace>

Could someone let me know what I'm doing wrong with IPtables?

  • The rules look fine to me, I would probably limit the source IP addresses on the SNAT, though that's not required. BUT you did reboot or run "sysctl -p" after changing that file didn't you ... – user3710044 Mar 16 '15 at 9:14
  • Yes I did reboot after the changes – James Mar 16 '15 at 10:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.