I am new to iptables and NAT. But I am working on it through various material both in online and books. I have a doubt regarding NAT implementation using iptables.

Let us suppose my network scenario is as shown below.

                  linuxbox2 (
linuxbox1-------- Switch ----- INTERNET
(        (

My Linux boxes 1 & 2 connect to the internet via switch and I have only one Public IP-Address( But the communication is a bit strange. box2 does not connect directly to outerworld via switch. But it is in vlan with box1. Hence traffice from box2 goes to box1 then travels down to switch to connect to outer world. We does natting at box1

Since we try to masquerade to the same public ip-address what should be the rules in iptable.

My question might be strange but I am not able to explain it clealry ...

Started a new thread with more details and outputs at

Iptables and SNAT

  • I don't understand your question. Why do you want to "differentiate the traffic originating from box 2 and 3 using nat table in box 1"? "what should be the rules in iptable which helps box1 in pre-routing the traffic to exact box" > it's taken care of automatically by netfilter which keeps track of which connections belongs to who. – Etienne Dechamps Oct 8 '09 at 8:32
  • Sorry folks I have done complete re-write of the question .... I am not sure if it is complete ... I might be updating even with more precise information once I am clear with my mind – codingfreak Oct 8 '09 at 8:55

If I understand your question well, Box 2 is in a VLAN with Box 1, and Box 1 is in another VLAN as well which has access to the Internet.

Assuming the first VLAN is e.g. VLAN 100 and the second VLAN is VLAN 200, I assume you configured VLANs correctly on Box 1 and thus you have two network interfaces for the two VLANs (typically eth0.100 and eth0.200).

In this case the solution is simple, on Box 1:

iptables -t nat -A POSTROUTING -o eth0.200 -j MASQUERADE

With this command Box 1 will NAT-masquerade packets to the Internet on VLAN 200. Thus when Box 2 will send packets to Box 1 on VLAN 100, Box 1 will forward them to VLAN 200.

Make sure IP forwarding is enabled on Box 1 (sysctl -w net.ipv4.ip_forward=1).

| improve this answer | |
  • @e-t172 I am very much thankful to u ... – codingfreak Oct 8 '09 at 9:31
  • One doubt ... When BOX2 and BOX1 try to do FTP to the same FTP server on INTERNET then how does the FTP server on internet differentiate BOX1 and BOX2 ... with the iptables rule which u have given for all the packets from both BOX1 and BOX2 we do POSTROUTING .. is that one rule enough ??? .. what about incoming packets destined to BOX1 and BOX2?? – codingfreak Oct 8 '09 at 9:38
  • You just need the POSTROUTING rule. Netfilter will handle incoming packets automatically thanks to connection tracking. – Etienne Dechamps Oct 8 '09 at 9:39
  • "how does the FTP server on internet differentiate BOX1 and BOX2" It doesn't. The two boxes have the same public IP address, so the external server can't differentiate between the two, that's the whole point of masquerading. Box 1 takes care of which packets goes to which box. – Etienne Dechamps Oct 8 '09 at 9:41
  • @e-t172 can I have the same nat based rule just with the IP-Addresses I have given. These private ip-addresses are permanent but there is a chance of change in VLANS .... so is there any another where I can set a nat rule just through ipaddresses ?? – codingfreak Oct 8 '09 at 9:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.