Questions tagged [masquerade]
The masquerade tag has no usage guidance.
77
questions
0
votes
1
answer
55
views
nftables masquerading is not working
I've a laptop (172.16.0.2) and a desktop PC (172.16.0.1). The phone is connected to the PC in USB modem mode, and it appears as the enp5s0f3u1 interface. I've set up masquerading through nftables so ...
- 1
0
votes
0
answers
23
views
Strongwan S2S VPN to Fortinet
I want to hide my local hosted server behind a public VPS. So i established a VPN between my local firewall(fortinet) and my
vps(strongswan).
Diagram
The VPN is up but no traffic at all. Even in ...
- 1
0
votes
0
answers
117
views
iptables masquerade traffic from ip range to specific interface
I have an environment where I have multiple network interfaces: eth0 and vpn1.
I am running docker which has an iptables masquerade rule to masquerade traffic from 172.17.0.0/16: -A POSTROUTING -s 172....
- 716
1
vote
0
answers
145
views
Combine MASQUERADING and NETMAP in iptables POSTROUTING
We have some clients (networks) which are connected via VPN to our server network.
Let's say client has e.g. 192.168.0.1/32 and our server network is on 10.1.0.0/24.
So the issue now with this client ...
- 156
0
votes
1
answer
529
views
Networking issue with Fedora Server 38 as a firewall / gateway
This environment has twins of virtually everything, including two web server / firewall / gateway systems, and they were getting long-in-the-tooth version wise, so I decided to upgrade from Fedora ...
- 1,226
1
vote
1
answer
357
views
firewall masquerade configuration not working
I'm using RHEL 8 and am trying to set-up NAT/MASQUERADE using firewall-cmd. So far I have all the network interfaces and services in the public zone. eno8303 is the internal nic and eno8403 is the ...
- 21
0
votes
1
answer
161
views
SNAT does not work to keep real client IP, MASQUERADE works
I have 3 hosts: AAA, BBB, CCC.
Host AAA is an OpenVPN server with IP 172.17.10.1 and mask 255.255.255.0.
Host BBB has 2 tun interfaces:
• an OpenVPN server with IP 172.16.10.1 and mask 255.255.255.0
•...
- 113
0
votes
0
answers
158
views
How to create access point or virtual access point in Fedora server 37 to access localhost too
Hi I am trying to create an access point in ideal case virtual access point in Fedora server 37.
I can create a simple AP for wifi to LAN(wlp7s0 -> enp1s0 in my case) using these commands and I can ...
0
votes
1
answer
2k
views
Wireguard tunnel without masquerade
Here is a network topology
The wireguard connection is initiated by the local server, calling the vps through its public IP. Their config files looks like this:
VPS
[Interface]
Address = 10.0.0.1/24
...
- 236
1
vote
0
answers
178
views
libvirt: how to use host OpenVPN connection
I have Ubuntu 22.04 with OpenVPN connection to remote network. I also have some number of VMs running on my machine. All of them are using one Virtual network to connect each other. Not all VMs ...
- 111
0
votes
0
answers
216
views
Sendmail 8.15 is not rewriting sender domain
Sendmail 8.15 on a RHEL 8 system.
I am able to send mail out, but when I receive it on the other end, the 'from' address is user@FQDN instead of user@MASQUARADE_AS
what we get: user@realhosname....
0
votes
0
answers
452
views
Sendmail does not masquerade the hostname.domain combination
My MASQUERADE settings looks as follows...
dnl # Also accept email sent to "localhost.localdomain" as local email.
dnl #
LOCAL_DOMAIN(`localhost.localdomain')dnl
dnl #
dnl # The following ...
- 1
0
votes
0
answers
242
views
UDP Broadcast not being masqueraded
I have a VM in Proxmox with an IP (192.168.1.10) coming from a bridge. I have masquerading on to enable it to communicate with my network:
-A POSTROUTING -s 192.168.1.0/24 -o host_inteface -j ...
- 1
1
vote
1
answer
666
views
Port forwarding while preserving the source IP address with firewalld
I signed up with a new ISP and they dont provide me with a external IPv4 address. Ive set up a virtual server (S) (that has an address) to relay all my stuff to my box at home (B) using a wireguard ...
- 11
1
vote
1
answer
336
views
How to block a internal host from the internet with firewalld by MAC address
I am trying to stop some hosts on the network from going outside/calling home.
So I have 2 zones.
[root@eagle ~]# firewall-cmd --get-active-zones
external
interfaces: enp2s0
internal
interfaces: ...
- 531
0
votes
2
answers
501
views
Masquerade / firewalld target : impacts on filtering?
I opened a question here, but as I found some new elements, I prefer to open a new one.
Here is my situation, that can be reproduced:
Fresh Centos7 OS. Configuration of two interfaces eth1 and eth2 ...
- 11
1
vote
0
answers
392
views
Linux Kernel IP Forward activated, firewalld is bypassed?
On a Linux Centos7, I have some traffic that is routed with static routes from one interface to another.
I did notice that with firewalld activated, both interfaces added in a zone, and nothing ...
- 11
0
votes
3
answers
708
views
why MASQUERADE SNAT can block localhost connection?
I observed a weird behaviour on linux:
First, I clean all routes and iptables rules:
ip route flush table main
ip route flush table default
ip route flush table local
iptables -P INPUT ACCEPT
iptables ...
2
votes
2
answers
3k
views
Unwanted masquerading in docker container
Although I have not added any iptables rules on the host or the two containers, packets from one docker container are modified and given the IP of the docker network gateway:
Container 1:
bash-5.0# ip ...
- 81
-2
votes
1
answer
68
views
Debugging my NAT setup
I'm trying to get a raspberry Pi3 to forward traffic coming in to wlan0 further upstream via eth0, but it is failing for some reason I cannot see. Hopefully someone else can spot the issues.
Pi3 state:...
- 1,873
0
votes
1
answer
789
views
PortForwarding eth0 to ppp0
I have a RaspberryPi which connects to the internet on eth0 which has static IP, I have installed Squid and I have also enabled 1694 port on my Mikrotik router to be forwarded to 3128 port on my ...
- 103
0
votes
1
answer
1k
views
Mikrotik - NAT over 2 ports - cant get it to work
I have a problem with setting up NAT over two ports in separate LANs (there is no internet involved in this).
Situation description:
Problem is that our PBX. It has some crazy network setup with loops ...
- 21
0
votes
2
answers
2k
views
Using nftables to forward HTTP(s) traffic to VM guest without masquerade
I am currently in the process of setting secure as possible KVM based server. The VM host should be more or less invisible to the internet and only VM guests running single services should be exposed.
...
- 118
1
vote
1
answer
4k
views
NFTables: is it possible to forward traffic without masquerading it?
I have a remote server (B) that forwards certain incoming traffic to another port of a different server (A, dest).
With "masquerade" I only see traffic coming from the forward server (B), is ...
- 25
0
votes
1
answer
1k
views
Can't get linux router/iptables masquerade working
Hope someone more clever than me could help because I am out of ideas...
We want to create (in openstack) a router that will...route (haha) trafic from one network to the other. Simple.
This is what I ...
3
votes
2
answers
3k
views
Why an iptables NAT does not happen in the network namespace separated transparent proxy setup?
I'm trying to setup transparent proxying networks on my host.
Real Client and Proxy targets are containters but in this experiment
I use netns (network namespace) separated envinroment.
To redirect ...
- 133
1
vote
0
answers
668
views
Dual-way NAT forwarding using IPVS?
I want to replace iptables(8) with IPVS for a TCP reverse proxy which involved dual-way NAT.
My current setup using iptables is functionally equivalent to a userspace forwarder (like socat(1)). It ...
- 1,242
0
votes
1
answer
1k
views
Is there a way to limit Src Ports in IPtables masquerading
I have the following chain setup by kube-proxy in my iptables on all my Nodes.
Chain KUBE-POSTROUTING (1 references)
target prot opt source destination
MASQUERADE all -- 0.0.0.0/...
- 387
1
vote
1
answer
348
views
How to preserve external IPs through gateway to keep using Fail2Ban
I have a CentOS 7 box with 2 NICs acting as a gateway; one NIC is connected to the internet while the other NIC is connected to our LAN.
The first NIC belongs to the 'external' zone of firewalld, it ...
- 45
1
vote
1
answer
444
views
Need correct iptable rules for NAT instance to prevent loop back for private subnet EC2 instance outgoing traffic
My AWS architecture has a public subnet having a NAT instance. It forwards the traffic on certain ports to my EC2 instance hosted in a separate private subnet.
sudo iptables -t nat -A PREROUTING -...
- 115
1
vote
1
answer
1k
views
How to NAT private IP to public IP through virtual LAN in centos 6
Guys i am having an issue with NAT on centos. In my LAB Centos is configured as a router. I want to run my local system (example: 192.168.1.45) apache server on live IP (example 112.100.4.34).
This ...
- 1,994
0
votes
2
answers
275
views
Any drawbacks to to using nat MASQUERADE with no source constraint (in a typical simple VPS setup)
Situation: A VPS already serving web pages via nginx. Now I am adding OpenVPN for roaming devices to this VPS.
One installation for the VPN guide suggests adding this MASQUERADE rule -
iptables -A ...
- 687
0
votes
1
answer
4k
views
Unable to NAT TFTP traffic because iptables is not forwarding the return connection to the client despite TFTP helper creating an expectation
The Problem
I have a TFTP server (Machine 'S') and a TFTP client (Machine 'C') on different subnets. They are connected via a router( Machine 'R'). All 3 machines are Debian 9/Stretch. The router is ...
1
vote
1
answer
54
views
Windows 98 routing issue [closed]
I have following network setup:
Main router connecting to internet, with LAN address 192.168.1.254
Secondary router connected to first router, with LAN address 192.168.2.1
I have two PC's connected ...
- 121
0
votes
1
answer
6k
views
Redirecting masqueraded traffic through TOR
I am trying to configure AP with redirection incoming traffic through TOR. My AP now has 2 network interfaces:
eth0 - have internet access (192.168.1.92/24)
wlan0 - intranet, without internet (10.0.0....
- 103
-3
votes
0
answers
112
views
How to use private IP address in router machine [closed]
I would like to use 192.168.11.1, but use global IP address againt my will.
I would not like to use global IP address in router when Im usging web browser and client applications.
How do I do ?
Now:...
0
votes
1
answer
93
views
Linux IP-tables Forwarding loose Source IP on access.log [closed]
Team,
We have configured IP tables with forwarding request coming on eth1(public IP x.x.x.x) interface to other server. We are able to forward all requests but problem is loosing origin public IP(...
0
votes
0
answers
1k
views
How do I get a PPTP server to have a static IP address per client?
I have an Ubuntu 16.04 server running a PPTP server.
The server is running fine, the pptp.conf file has the following:
localip 10.1.1.2
remoteip 10.1.1.3-252
The chap-secrets file is setup to give ...
0
votes
0
answers
1k
views
Router with DHCP in Centos 7? Where can be an error in settings?
I'm looking for a thorough tutorial on how to configure:
Modem (77.77.7.76) -> Centos 7 -> 192.168.1.0 -> DHCP -> 100 host
Please look at my configuration.
Two network interfaces:
enp0f0
enp0f1
On ...
-1
votes
1
answer
747
views
firewalld masquerade control [closed]
for various reasons I have had to adopt CentOS 7 as a public facing firewall machine implementing NAT and a few other bits and pieces.
Seems easy enough.
My basic strategy is to assign the outside ...
2
votes
0
answers
198
views
natting ftp server inside lan with gateway port 1965
I want to forward access on my gateway (internal ip: 192.168.4.4) from external port 1965 to a FTP server inside my lan (192.168.4.2)
So in other term, someone accessing with FTP my gateway:1965 will ...
- 66
1
vote
0
answers
53
views
Same network, two interface cards, hosts behind different networks
Can anyone help with this?
I have a gadget that has a fixed IP address 10.0.0.2, which I cannot change. It needs to talk to my laptop, which in turn needs to talk to the internet.
My main network ...
- 113
-1
votes
2
answers
7k
views
How to Access a host behind a server over VPN (IP Forwarding)
I have a Ubuntu server (172.10.200.11) and many remote terminal units with simcards and each individual simcard operator using different IP pool such as 10.57.0.0/16 for OP-A, 10.112.0.0/16 for OP-B, ...
1
vote
2
answers
2k
views
Is it possible to masquerade a packet on a bridge?
I have a container which has an incoming VPN. A connection into that container will be assigned the 192.168.10.10 IP. The virtual NIC of the container has an IP of 10.10.10.1 and a gateway (on the ...
- 3,607
3
votes
0
answers
624
views
avoid packets being treated as "martians": is this thinking correct?
I have a cable connection with a Linux-based router. The router has two physical interfaces:
enp1s0 (dhcp from cable provider)
enp2s0 (192.168.1.1)
with masquerading on enp1s0. then, I have an ...
- 176
1
vote
1
answer
439
views
NAT Masquerading second container network
I have 1 public IP, and would like to share internet connection to LXC containers running Centos (in this setup) the host runs proxmox (debian based). If I understand correctly, i need NAT ...
- 749
0
votes
1
answer
1k
views
netperf + iptables masquerade -> network unreachable
Why iptables rules pass netperf TCP_STREAM test through, but break UDP_STREAM?
I have a network:
+---------------+
| |
[client]--[NAT]--[server]
On the NAT, I have added the ...
- 163
2
votes
1
answer
880
views
Why IP masquerade (source NAT) in linux kernel fails to set source IP on high packet rates
I am trying to test throughput of the standard linux NAT. I have setup the following virtual network:
[192.168.42.5] <--> [192.168.42.2:192.168.35.2] <--> [192.168.35.10]
The middle host ...
- 163
1
vote
1
answer
566
views
DNAT for connecting a subnet via proxy to the internet
DNAT for connecting a subnet via proxy to the internet
I want to connect a server in a subnet to the internet via a proxy-server. But I can’t ping a host on the internet (www).
Actually the subnet-...
- 11
1
vote
1
answer
1k
views
ICMP ECHO REPLY is not being SNATed correctly
I am trying to provide L3 connectivity between two remote LAN networks (10.0.0.0/24, 10.0.1.0/24) using OpenVPN with the following setup:
+----------------+ +---------------------+ +----------------...
- 13