Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Suppose there are hosts A and B. A is allowed SSH access to B based on its IP address. Consider now another host C. C does not have access to B, but if we could route its traffic through A, then C could access B. The problem is, how to do this kind of address translation? No two hosts are on the same LAN.

My first thought was to do SNAT with iptables on A:

iptables -t nat -A POSTROUTING --protocol tcp --source C --destination B --sport 7777 --dport 22 -j SNAT A

meaning that C should try to connect to A:7777 but I realized that routing the packet before SNAT spoils everything, therefore address translation should be done in PREROUTING -- which unfortunately is impossible. Another thought was to set up a VPN, but I think it is too complicated. Is there a neat way to do this, preferably with something as clean as iptables?

share|improve this question
You need dual NAT -- destination NAT before routing and source NAT after routing. See this answer for an example of dual NAT. – David Schwartz Nov 9 '12 at 3:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.