0

I need to forward traffic coming into a cloud-provisioned Ubuntu VPS at 1.1.1.100 on port 1234 to port 5678 on local Windows computer (192.168.0.200, which is behind a router at 2.2.2.200 / 192.168.0.1), but to preserve the originating IP address. The router forwards port 5678 to the Windows machine.

When I run this on the VPS:

iptables -t nat -A PREROUTING -p tcp --dport 1234 -j DNAT --to-destination 2.2.2.200:5678 iptables -t nat -A POSTROUTING -p tcp -d 2.2.2.200 --dport 5678 -j SNAT --to-source 1.1.1.100

This works to forward the packets, but the server at 2.2.2.200 thinks everything is coming from 1.1.1.100. The originating IP is lost.

Question 1: can I accomplish what I need with just iptables on the VPS? (I think the answer is No, but I'd love to be wrong.)

Question 2: can I manipulate iptables and/or routes on the router at 2.2.2.200 to accomplish this? What do I need to add to the router's iptables, and what do I need to change in the VPS's iptables?

  • 1
    Why are you doing SNAT here? – Tero Kilkanen Apr 20 '19 at 10:04
  • You'll have to use a tunnel because 1.1.1.100 is not in the path between the random client and the windows system. – A.B Apr 20 '19 at 11:51
  • Would the SNAT work if I told the router to route all traffic from 192.168.0.200 back to 1.1.1.100? – ras Apr 20 '19 at 13:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.