1

I have a Linux host serving as a source NAT (SNAT). It receives all packets for the default route from the internal network on an internal interface with IP 192.168.2.1. The SNAT host has multiple outbound IP addresses (e.g. 3.3.3.3, 3.3.3.4, 3.3.3.5, ...).

I would like to configure iptables (or some other tool on Linux - it doesn't have to be iptables - but I think that's the right tool) such that the port on which a packet arrives on the internal, private IP determines the IP on which the request is sent out and the outbound port is constant (e.g. port 80).

For example, the below mapping might be prototypical (all of these would be received on 192.168.2.1, but with a Destionation IP of the IP listed first in the mapping ... -> indicates the SNAT device):

  • (src) 192.168.x.y:z (dest) 10.10.10.10:8001 -> (src) 3.3.3.3:r (dest) 10.10.10.10:80
  • (src) 192.168.x.y:z (dest) 11.11.11.11:8002 -> (src) 3.3.3.4:r (dest) 11.11.11.11:80
  • (src) 192.168.x.y:z (dest) 12.12.12.12:8003 -> (src) 3.3.3.5:r (dest) 12.12.12.12:80
  • (src) 192.168.x.y:z (dest) 13.13.13.13:8004 -> (src) 4.4.4.3:r (dest) 13.13.13.13:80

(192.168.x.y could be any host on the private network. ports z and r are almost certainly ephemeral ports, and are obviously different for each session, but the SNAT obviously needs to manage that state to get responses back to the correct requestor)

Here is a concrete example:

A packet might originate from an interface on the private network (e.g. 192.168.2.5). The source IP will therefore be "192.168.2.5". The destination IP might be "10.10.10.10" and the destination port might be "8001". The routing table tells the local IP router to send all packets destined for "0.0.0.0/0" to 192.168.2.1 and there is no more specific route table entry. So the packet arrives at 192.168.2.1 (the SNAT) with a destination IP of 10.10.10.10 and destination port of 8001. If that happens, I want the NAT to send the packet out on 3.3.3.3:r with a destination of 10.10.10.10:80 (the 3.3.3.3 would obviously have to be defined in a mapping and should be based on the original destination port of 8001).

I think this would be relatively trivial with iptables if it weren't for the requirement to change the destination port - but that wrinkle throws me for a loop.

How can I achieve this?

3
  • Could you clarify "the port on which a packet arrives"? It looks like you're talking about source IP addresses, but destination port numbers, yet your prototype example freely mixes both. – user1686 Jun 25 '19 at 15:14
  • 1
    @grawity: Thanks for asking for clarification - you're correct - I totally mangled the question. Clarified significantly now, I believe. Ping again if not :) – Jared Jun 25 '19 at 22:13
  • Wow...I re-read my edit and the last paragraph was still mangled. Fixed now, I hope. – Jared Jun 25 '19 at 22:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.