Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to change source ip address according to ip address and interface it came in. Let's consider following example:

  |                            |
  |          host 1            |
  |                            |
  |        application         |
  |                            |
  |                    eth0    |
                         |  IP0-IP47
          |             eth0           |
          |         host 2             |
          |                            |
          |         NAT                |
          |                            |
          |  eth1.1   eth1.2  eth1.3   |
              |         |        |
              |         |        | 
         IP0-IP15   IP0-IP15   IP0-IP15

Host 2 is receiving messages on interfaces eth1.1, eth1.2, eth1.3. On each interface there are 16 hosts with 16 unique ip addresses, but these 16 ip addresses are the same on all interfaces. I need to do NAT so the source ip is altered based on src ip and interface it came in in order to have 48 unique source ip addresses for messages going to application.

Application running on the most-down hosts and their ip cannot be changed. That's why i decided to put them into VLANs.

I searched through various tutorials and HOWTOs but I was unable to find what I am looking for. The problem is: SNAT is usable only in POSTROUTING chain, but in POSTROUTING I do not have information about the interface it came in.

Am I right with my assumption? I am new to this network stuff so any help and advice would be helpful.

Thanks for your help.

share|improve this question

migrated from Feb 12 '13 at 10:39

This question came from our site for professional and enthusiast programmers.

Probably you can do this:

  1. Mark packets coming from different interfaces with different numbers at the time of PREROUTING.

    sudo iptables -t nat -A PREROUTING -i eth1.<x> -j MARK --set-mark <choose_a_unique_number_per_interface>
  2. Use SNAT and marks at the time of post-routing:

    sudo iptables -t nat -A POSTROUTING -s <iprange_of_eth1.<x>> -m mark --mark <number_given_to_eth1.<x>_at_the_time_of_prerouting> -j SNAT --to-source <an_ip_from_48_ipset>
share|improve this answer
Thanks. That will probably solve my problem. – user2063933 Feb 15 '13 at 6:36
up vote 0 down vote accepted


Since the destination for the packets was the machine on which the NAT ran, I couldn't use POSTROUTING chain.

For others with the same problem: check xtables-addons : RAWNAT target

It allows you to use stateless SNAT in PREROUTING. That was exactly what I was looking for. You just have to build the module and load it (e.g. with modprobe).

If you will be implementing this, don't forget it is stateless NAT so it will not do reverse NAT automatically as SNAT and DNAT do. Therefore you need to implement your own reverse NAT rules.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .