-1

For some reasons I need to switch a server ip to another ip, in order to be seen by another computer elsewhere through vpn. So I'm using iptables (didn't know any of that until yesterday) and testing with some result in my own network as follows:

  • serverA = 172.19.128.239
  • ubuntu = 172.19.128.237
  • clientB = 172.19.128.248

clientB can request directly to serverA a service, and serverA provides it.

then I want that clientB requests the service to ubuntu, then ubuntu asks for it to serverA; serverA will answer to ubuntu and ubuntu will answer to clientB, which receives the service without ever knowing serverA

it's working using the following instructions:

sysctl net.ipv4.ip_forward=1
iptables -t nat -A PREROUTING -p tcp --dport 28000 -j DNAT --to-destination 172.19.128.239:28000
iptables -t nat -A POSTROUTING -p tcp -j SNAT --to-source 172.19.128.237

Please note that in order it to work, I need to reset the source address to the ubuntu, so that clientB receives it as if would be the same IP he specified. I don't know for what reason it would work also if I set instead of SNAT instructions, a MASQUERADE one:

iptables -t nat -A POSTROUTING -j MASQUERADE

So this test is success, but, I need to make the same thing using another IP in another network connected through VPN (ipsec), namely serverA2 192.168.200.202

so I try to substitute to the above the ip as follows:

sysctl net.ipv4.ip_forward=1
iptables -t nat -A PREROUTING -p tcp --dport 28000 -j DNAT --to-destination 192.168.200.202:28000
iptables -t nat -A POSTROUTING -p tcp -j SNAT --to-source 172.19.128.237

But it doesn't work. Notice that the VPN is working flawlessly as I can ping serverA2 192.168.200.202 both from clientB and from ubuntu. Also, it works even if I connect directly clientB to serverA2 without passing from ubuntu.

For me now is obscure, what should I check?

2
  • Can you provide your routing table for all 3 systems?
    – CIA
    Jul 2, 2015 at 14:18
  • I can for clientB (windows) and ubuntu, what command have i to input? Jul 2, 2015 at 14:40

1 Answer 1

1

Solved: I put the following commands, I missed one.

iptables -t nat -A PREROUTING -s 172.19.128.248 -j DNAT --to-destination 192.168.200.202
iptables -t nat -A PREROUTING -s 192.168.200.202 -j DNAT --to-destination 172.19.128.248
iptables -t nat -A POSTROUTING -p tcp -j SNAT --to-source 172.19.128.237

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .