Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm trying to add the line

-A POSTROUTING -i ppp0 -j MASQUERADE

to my IPTables in order to allow VPN to have access to the entire internal and external network (eth0, and eth1), but when I try to apply it, it pops the error message:

iptables-restore v1.4.18: Can't use -i with POSTROUTING

Is there any way to allow access to both eth0 and eth1 from ppp0 without allowing access to eth1 from eth0? Is there an alternative I haven't thought of? Here's my ifconfig:

david@Mathusala ~ $ ifconfig
eth0      Link encap:Ethernet  HWaddr 6c:f0:49:57:03:fc  
          inet addr:50.139.49.92  Bcast:255.255.255.255  Mask:255.255.252.0
          inet6 addr: fe80::6ef0:49ff:fe57:3fc/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:42542255 errors:0 dropped:0 overruns:0 frame:0
          TX packets:19116720 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:38763455707 (38.7 GB)  TX bytes:3931758927 (3.9 GB)

eth1      Link encap:Ethernet  HWaddr 6c:f0:49:57:03:ec  
          inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::6ef0:49ff:fe57:3ec/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:34175606 errors:0 dropped:2 overruns:0 frame:0
          TX packets:63558373 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:7313801292 (7.3 GB)  TX bytes:83294618259 (83.2 GB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:1033589 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1033589 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:4320636783 (4.3 GB)  TX bytes:4320636783 (4.3 GB)

ppp0      Link encap:Point-to-Point Protocol  
          inet addr:192.168.1.1  P-t-P:192.168.1.234  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1486  Metric:1
          RX packets:13 errors:0 dropped:0 overruns:0 frame:0
          TX packets:6 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:3 
          RX bytes:512 (512.0 B)  TX bytes:96 (96.0 B)

Thank you!

share|improve this question
    
I don’t see how MASQUERADE relates to forwarding rules, to be honest. It works on outgoing packets by the way and must be used with -o. –  Daniel B May 27 at 5:30
    
You should clarify your question: are you running a VPN client or server? What is your local configuration, i.e. VPN interface, LAN interface, WAN interface? What exactly are you trying to achieve? BTW: -j MASQUERADE is used to change the source address of outgoing packets, to make them look as if they were all coming from the same IP (of course, track is kept of who, exactly, is having a communication). How does this help you? –  MariusMatutiae May 27 at 7:43
    
This is the server I'm talking about... Sorry for not clarifying. The server handles the internet on eth0, and a NAT on eth1. I'm trying to masq so that the client connecting to the server with ppp0 can connect to the NAT. –  vroomhenderson May 27 at 22:34

1 Answer 1

The error is correct; you cannot screen by input interface at POSTROUTING.

try this instead

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
share|improve this answer
    
Thanks for the answer, but I've already got that in there to allow masquerading from eth1 and ppp0 to eth0. What I'm trying to do is to exclusively masquerade ppp0 to eth1 without masquerading eth0 to eth1 as well. –  vroomhenderson May 30 at 2:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.