Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I would like to change source ip address according to ip address and interface it came in. Let's consider following example:

  -----------------------------
  |                            |
  |          host 1            |
  |                            |
  |        application         |
  |                            |
  |                    eth0    |
  -----------------------------
                         |
                         |  IP0-IP47
                         |
          -----------------------------
          |             eth0           |
          |         host 2             |
          |                            |
          |         NAT                |
          |                            |
          |  eth1.1   eth1.2  eth1.3   |
          -----------------------------
              |         |        |
              |         |        | 
         IP0-IP15   IP0-IP15   IP0-IP15

Host 2 is receiving messages on interfaces eth1.1, eth1.2, eth1.3. On each interface there are 16 hosts with 16 unique ip addresses, but these 16 ip addresses are the same on all interfaces. I need to do NAT so the source ip is altered based on src ip and interface it came in in order to have 48 unique source ip addresses for messages going to application.

Application running on the most-down hosts and their ip cannot be changed. That's why i decided to put them into VLANs.

I searched through various tutorials and HOWTOs but I was unable to find what I am looking for. The problem is: SNAT is usable only in POSTROUTING chain, but in POSTROUTING I do not have information about the interface it came in.

Am I right with my assumption? I am new to this network stuff so any help and advice would be helpful.

Thanks for your help.

share|improve this question

migrated from stackoverflow.com Feb 12 '13 at 10:39

This question came from our site for professional and enthusiast programmers.

add comment

2 Answers

Probably you can do this:

  1. Mark packets coming from different interfaces with different numbers at the time of PREROUTING.

    sudo iptables -t nat -A PREROUTING -i eth1.<x> -j MARK --set-mark <choose_a_unique_number_per_interface>
    
  2. Use SNAT and marks at the time of post-routing:

    sudo iptables -t nat -A POSTROUTING -s <iprange_of_eth1.<x>> -m mark --mark <number_given_to_eth1.<x>_at_the_time_of_prerouting> -j SNAT --to-source <an_ip_from_48_ipset>
    
share|improve this answer
    
Thanks. That will probably solve my problem. –  user2063933 Feb 15 '13 at 6:36
add comment
up vote 0 down vote accepted

Solved.

Since the destination for the packets was the machine on which the NAT ran, I couldn't use POSTROUTING chain.

For others with the same problem: check xtables-addons : RAWNAT target http://manpages.ubuntu.com/manpages/karmic/man8/xtables-addons.8.html

It allows you to use stateless SNAT in PREROUTING. That was exactly what I was looking for. You just have to build the module and load it (e.g. with modprobe).

If you will be implementing this, don't forget it is stateless NAT so it will not do reverse NAT automatically as SNAT and DNAT do. Therefore you need to implement your own reverse NAT rules.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.