I am a newbie to iptables with NAT. My network setup is as shown below

                  linuxbox2 (192.x.y.a)
(             |
linuxbox1(eth1)-------- Switch ----- ftpserver

BOX1 and BOX2 are in VLAN tagging via switch. BOX1 is in a VLAN tag with FTPserver. So BOX2 inorder to connect to the FTPserver should route via BOX1 which should has to do POSTROUTING(SNAT) and send the FTP packets to FTPserver.

eth1 interface is configured with 2 IP-addresses one public and one private addresses.

All the traffic from BOX2 is routed to BOX1. I added following rules in my iptables setup present in BOX1

$IPTABLES -t mangle -A PREROUTING -p tcp --dport 21 -s 192.x.y.a -j ACCEPT
$IPTABLES -t mangle -A FORWARD -p tcp --dport 21 -s 192.x.y.a -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -t nat -A POSTROUTING -s 192.x.y.a -p tcp --dport 21 -j SNAT --to-source

Editing the question with new upgrades

If I ping from BOX2 to BOX1 it is working fine. If I try to perform ftp to the Ftpserver then NAT table in iptables script present in BOX1 is invoked and ftp is not successful.

If I do the tcpdump at eth1 I do see ftp packets coming from BOX2 to BOX1 but no packets leaving from BOX1 to ftpserver.

IP 192.x.y.a.45388 > 10.p.q.r.21(ftpserver): S 1380128644:1380128644(0) 
win 5840 <mss 1460,sackOK,timestamp 16897

0,nop,wscale 2> IP 192.x.y.a.45388 > 10.p.q.r.21: S 1380128644:1380128644(0) win 5840 IP 192.x.y.a.45388 > 10.p.q.r.21: S 1380128644:1380128644(0) win 5840

Actually 3 packets are sent from BOX2 to BOX1. Counters for various chains like prerouting, forward shows count as 3 while POSTROUTING chain in NAT table shows a count of 1. But TCPDUMP doesnt show any packet leaving to FTPSERVER.

Now after some tweaking and adding LOG support to the iptables I found out that after getting NATted packets are routed towards ETH0 of BOX1. So I fixed the routing thing and now the packets are leaving through ETH1 to FTPserver and receiving packets back from FTPserver to ETH1.

But a new problem starts here. My iptables setup says - Only packets having appropriate rule in IPTABLES are accepted [might be contradictory for others usage] else DROPPED.

My doubt is the destination IP-address of the packet is public IP-address of ETH1 which is present on BOX1. At the routing decision node will the packet still be accepted for routing so it goes through forward?

I see that routing is not done and the packet is thought as local packet which is getting DROPPED since there is no appropriate rule for it ...

I heard that connection tracking mechanism maintains data regarding packets undergone NATting .. so when does the packet's source address get converted back to original destination address?

Check the netfilter packet flow image for more clarification http://l7-filter.sourceforge.net/PacketFlow.png

NOTE: All my IPTABLE rules should be based on IP-address but not on interface as there is a chance of change in interface names but in IP-addresses.

  • You are doing a real mess. (1) Where are you placing these iptables rules? (2) What is the point of the two 'mangle' chain rules? (3) What is the point of VLANs in your setup? (4) Where is your external router? (5) Is box1 configured to act as a router? (6) Is box2 configured to use box1 as its default route? – Juliano Oct 26 '09 at 11:42
  • Seems you get simply confused with the whole setup. 1. What you mean by "Where do you place these iptable rules?" 2. They are prerouting and forward chains under mangle table ?? 3. Lol my setup is designed in that way with VLANS .. any problem ?? 4. Switch is directly connected to the FTPSERVER ... sorry about the internet. 5. BOX1 is just configured as a NAT box 6. Yes BOX2 is configured to use BOX1 as default route. – codingfreak Oct 26 '09 at 12:15
  • I guess the three iptables rules you listed are set in box1? Reread your question, you say there are these iptables rules but you don't say in which box they are set. The first two rules (in the 'mangle' chain) are wrong. The 'mangle' table serves to modify packets as they travel through netfilter. Although iptables allows you to use the 'ACCEPT' in 'mangle' table rules, it is not the correct usage. Perhaps you intended to use the 'filter' table. Check the iptables manual for the difference between the tables. – Juliano Oct 26 '09 at 12:28
  • From your explanation, you do not need NAT at all in your setup (since ftpserver is connected to the switch). NAT is to be used when you have address shortage and you need to transverse to the outer network with a single (or few) address. From your description, there is no problem for the ftpserver to see your box2 address as long as it knows how to route packets back. If the ftpserver address is 10.p.q.r, then you are missing a lot of information: what are the other addresses of box1, and the routing tables of all parts involved. – Juliano Oct 26 '09 at 12:35
  • Eventhough BOX1, BOX2 and FTP server are connected to the SWITCH they have VLAN tagging. Only BOX1 is connected to the FTP server and BOX2 is connected in VLAN to BOX1. So traffic from BOX2 should route through BOX1 and then connect to FTPserver. Since I have to protect the private address of BOX2 I decided to use NAT. – codingfreak Oct 26 '09 at 13:53

Remove the three rules you have above and try adding this:

$IPTABLES -t NAT -A POSTROUTING -s 192.x.y.a -j SNAT 192.x.y.b

And enter the following command:

echo 1 > /proc/sys/net/ipv4/ip_forward

You should also have a rule similar to the following in your firewall:


That will take care of all established/related connections, instead of making a rule for each one.

| improve this answer | |
  • Sorry but I already told not to add rules based on interface. I think masquerade is only used in the case if ip-address is assigned by DHCP server. What is the need of masquerading when I can directly use SNAT ?? /proc/sys/net/ipv4/ip_forward value is already set to 1. – codingfreak Oct 26 '09 at 14:55
  • Editted my post based on your by-IP only requirement (sorry I missed that the first time) and SNAT. And you're right, MASQUERADE is generally used in a dynamic environment, but it would provide the same functionality. – kingfish Oct 26 '09 at 15:14
  • What is the difference between your rules and mine ?? I am using prerouting and forward chains under MANGLE table and your postrouting rule under NAT table is similar to mine ... – codingfreak Oct 27 '09 at 2:57
  • Your PREROUTING mangle rule is not needed. I tweaked a lab environment I have to replicate your environment and verified this. Also verified that your mangle FORWARD and nat POSTROUTING rules will give you with the functionality you desire. I verified that my suggested rules work too. This leads me to believe that your problem is located elsewhere. I would verify that you don't have any other rules in your iptables config that are taking precedence over the rules above. Also make sure ip_forward is set to 1. – kingfish Oct 27 '09 at 18:02
  • Kingfish .. thanks for your efforts and quick reply .. I just modified the question with my latest problem on the same setup – codingfreak Oct 30 '09 at 4:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.