2

I have a slight Problem with my NAT-Setup.

What I'm trying to do:

I have 2 VLANs (in this example 100 and 200) and want that they can access the Network via separate IPs. This should be accomplished by a iptables NAT. I created this setup with pf (FreeBSD) but unfortunately the hardware I have to use is not compatible. I would love to that within our main router, but the CPU cannot handle such loads. With IP-Tables etc. I'm just a noob ;) Schema:

User on VLAN 100 (10.100.0.0/24) -> 10.100.0.1 NAT xxx.yyy.zzz.6 -> Network

User on VLAN 200 (10.200.0.0/24) -> 10.200.0.1 NAT xxx.yyy.zzz.7 -> Network

All of this on the same physical Interface, with VLAN Interfaces etc.

This is my current config: /etc/network/interfaces

    lo ....

    iface ens2f3 inet static
        address xxx.yyy.zzz.6
        netmask 255.255.252.0

auto ens2f3.100
iface ens2f3.100 inet static
        address 10.100.0.1
        netmask 255.255.255.0
        vlan-raw-device ens2f3

iface ens2f3 inet static
        address xxx.yyy.zzz.7
        netmask 255.255.252.0

auto ens2f3.200
iface ens2f3.200 inet static
        address 10.200.0.1
        netmask 255.255.255.0
        vlan-raw-device ens2f3

/etc/iptables/rules.v4 (automatically loaded)

#NAT TABLE
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 10.100.0.0/24 -o ens2f3 -j SNAT --to-source xxx.yyy.zzz.6
-A POSTROUTING -s 10.200.0.0/24 -o ens2f3 -j SNAT --to-source xxx.yyy.zzz.7

COMMIT

# General Table
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
COMMIT

# I know this setup is very insecure! I lockdown the server when I got NAT working

The Problem is that I can get with a 10.100.0.100 I can connect onto xxx.yyy.zzy.1 with exactly this IP (10.100.0.100; which shouldn't be possible) instead of the IP I should have obtained via NAT.

I've also tried marking the packages when they arrive at the interface and have seperate routing tables for them. There the problem above doesn't exist, but no connection to anywhere is possible

Could you please provide me tips on how to realize this with a Linux-based OS. If necessary I have another 10G Interface available

2

I haven't analyzed everything, but step one is to correct this:

-o ens2f3

since you are postROUTING, the routing decision has been made and I expect the packet is going straight to gateway xxx.yyy.zzz.1 so through a different interface:

-o enp3s0
  • Ok, thanks. That makes perfect sense. I realistically don't need the interface so I removed it. But still not working. Do I need seperate Routing-Tables for each VLAN-Interface / NAT Combination or is it possible to resolve this issue by using a prerouting rule? – WhoAmI Aug 13 '17 at 21:38
  • Depends what is not working. From point of view of iptables all seems fine, as long as you asked the question correctly. Do you have ip forwarding enabled on this system, sysctl net.ipv4.ip_forward? You can observe with tcpdump packets coming from hosts on VLANs and see if they leave the system via the uplink. You will see if they get SNATed correctly or not. – TuxPowered Aug 21 '17 at 9:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.