I have a network like this:


And I need each Black box to operate from a sepcific IP of Server B.
Both server run Debian 9. I can only change network settings (IP/Gatway etc) but nothing else on those blackboxes. How do I do this?

Something around this? Setting gateway of the boxes to

Server A

iptables -A FORWARD -s -o tun0 -j ACCEPT  
iptables -t nat -A POSTROUTING -s  -j SNAT --to  
iptables -t nat -A POSTROUTING -s  -j SNAT --to  
iptables -t nat -A POSTROUTING -s  -j SNAT --to  
iptables -t nat -A POSTROUTING -s  -j SNAT --to  

Server B

iptables -A FORWARD -s -o eth0 -j ACCEPT  
iptables -t nat -A POSTROUTING -s  -j SNAT --to xxx.xxx.xxx.xxx
iptables -t nat -A POSTROUTING -s  -j SNAT --to yyy.yyy.yyy.yyy    

I can only change network settings (IP/Gatway etc) but nothing else.

Then it is not possible. Your question doesn't specify if you need 2-way connections (i.e. having "black boxes" accessible from the Internet) or not, but anyways this would require at least iptables for SNAT and advanced policy-based routing with iproute2.

Added after original question was edited:

Yes, something like this could work. But that is strongly dependent on your OpenVPN settings. Those local IPs from the VPN subnetwork ( should be set up on your Server A and routed through VPN tunnel. Also do not forget to allow related packets coming back. This is usually done with something like this rule:

iptables -A FORWARD -i tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT

On Server A. And the respective rule for -i eth0 on Server B. And you have to set Server A as default gateway for "black boxes".

But instead of doing overhead of double SNAT, you might also consider setting up your OpenVPN to allow to route subnetwork directly to and from Server B. There are multiple tutorials on the Internet on this configuration.

| improve this answer | |
  • sorry i should have made it more clear that i can freely work on the 2 servers. my limits only count for the black boxes. And i do not need them to be accessible from the internet – timo Sep 19 '17 at 12:34

You can not "assign" external IPs like this. However you can do IP NAT or TCP/UDP port forwarding using iptables and SNAT module.

| improve this answer | |
  • i have updated my question, is this what u mean? – timo Sep 19 '17 at 13:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.