0

I am running a simple expirement for validating some NAT concepts with IPtables.

I have a Firewall with two interfaces connecting two networks:

Network A - 192.168.0.0/24 - connected to eth0 - Firewall's IP: 192.168.0.1
Network B - 192.168.1.0/24 - connected to eth1 - Firewall's IP: 192.168.1.1

I've applied the following DNAT rule to the FW:

iptables -t nat -A PREROUTING -d 192.168.1.1/32 -j DNAT --to-destination 192.168.0.2

Traffic gets redirected properly to the host 192.168.0.2, this is a sample captured from the .0.2 host:

16:17:40.005055 IP 192.168.1.2 > 192.168.0.2: ICMP echo request, id 15106, seq 1285, length 64 16:17:40.005133 IP 192.168.0.2 > 192.168.1.2: ICMP echo reply, id 15106, seq 1285, length 64

However I see something very interesting when I capture this same traffic from the FW HOST.

When I capture it from eth0 I see the traffic as expected, echo replys are coming with the IP: 192.168.0.2

But when I do the same thing for eth1, this is what I see:

16:21:44.348196 IP 192.168.1.2 > 192.168.1.1: ICMP echo request, id 15106, seq 1527, length 64 16:21:44.360376 IP 192.168.1.1 > 192.168.1.2: ICMP echo reply, id 15106, seq 1527, length 64

If you pay attention to the echo reply, the source IP is 192.168.1.1. How that is possible if we just saw the original packages from 192.168.0.2 when we looked at eth0?

As one can see, there is no SNAT or Masquerade rule configured on the FW:

FIREWALL:~# iptables -t nat -L

Chain PREROUTING (policy ACCEPT) target     prot opt source           
destination          DNAT       all  --  anywhere            
192.168.1.1         to:192.168.0.2 

Chain POSTROUTING (policy ACCEPT) target     prot opt source          
destination         

Chain OUTPUT (policy ACCEPT) target     prot opt source              
destination

There is only the original DNAT rule.

So why is the kernel masquerading my packages? I know that is is advisable to do SNAT in conjunction to DNAT, but that is no my point. I want to understand why that is happening if I did not tell the IPtables to do so. Is it possible that the kernel does that without consulting iptables/netfilter rules?

  • What is your default gateway? route -n Is 192.168.1.1 a host? Perhaps you are getting a response from 192.168.1.1? – varlogtim Aug 14 '18 at 17:41
  • Yes, 192.168.1.1 is the Firewall's IP. 192.168.1.1 is gateway for network B and 192.168.0.1 is gateway for network A. Both IPs belongs to the FW. – vinicius.olifer Aug 14 '18 at 19:02
0

That is the effect of your DNAT rule. You want the address changed, so on one side you have the original packets and on the other side you have the changed packets. That is the whole point of NAT.

Edit

From the manual

It specifies that the destination address of the packet should be modified (and all future packets in this connection will also be mangled)

That means that not just the package starting the connection will be modified, but also all responses, and all further packets sent.

  • Right, but DNAT is for Destination address translation right? I am ok with that, but why the Source address from the reply packets are translated too? What is the relation between DNAT and Source Addresses? – vinicius.olifer Aug 14 '18 at 19:48
  • It is the source address of the ICMP reply that is modified, together with the destination address for the request, that you didn't highlight. DNAT changes the destination of the request. As the source of the reply is the destination of the request, It must also change the source of the reply. The original sender expects a reply from the original destination. – RalfFriedl Aug 14 '18 at 19:54
  • Right I agree that the 'original sender expects a reply from the original destination', that is why I thought I had to configure a SNAT rule for each DNAT rule I have, in order to meet sender's expectation. I read that in some places like: thewiringcloset.wordpress.com/2013/03/27/… But, from what you are telling me, the DNAT rule is enough by itself? It does not need an auxiliary SNAT rule for the response traffic? – vinicius.olifer Aug 14 '18 at 20:28
  • One DNAT is enough to handle everything. The link you refer to is nonsense. It may still work with the additional SNAT, but it is not necessary. – RalfFriedl Aug 14 '18 at 20:35
  • Right, I am glad I will teach the right thing to my students on today's class about Iptables. Thanks for your time and contribution sir. – vinicius.olifer Aug 14 '18 at 20:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.