I have a Linux host serving as a source NAT (SNAT). It receives all packets for the default route from the internal network on an internal interface with IP 192.168.2.1. The SNAT host has multiple outbound IP addresses (e.g. 22.214.171.124, 126.96.36.199, 188.8.131.52, ...).
I would like to configure iptables (or some other tool on Linux - it doesn't have to be iptables - but I think that's the right tool) such that the port on which a packet arrives on the internal, private IP determines the IP on which the request is sent out and the outbound port is constant (e.g. port 80).
For example, the below mapping might be prototypical (all of these would be received on 192.168.2.1, but with a Destionation IP of the IP listed first in the mapping ... -> indicates the SNAT device):
- (src) 192.168.x.y:z (dest) 10.10.10.10:8001 -> (src) 184.108.40.206:r (dest) 10.10.10.10:80
- (src) 192.168.x.y:z (dest) 220.127.116.11:8002 -> (src) 18.104.22.168:r (dest) 22.214.171.124:80
- (src) 192.168.x.y:z (dest) 126.96.36.199:8003 -> (src) 188.8.131.52:r (dest) 184.108.40.206:80
- (src) 192.168.x.y:z (dest) 220.127.116.11:8004 -> (src) 18.104.22.168:r (dest) 22.214.171.124:80
(192.168.x.y could be any host on the private network. ports z and r are almost certainly ephemeral ports, and are obviously different for each session, but the SNAT obviously needs to manage that state to get responses back to the correct requestor)
Here is a concrete example:
A packet might originate from an interface on the private network (e.g. 192.168.2.5). The source IP will therefore be "192.168.2.5". The destination IP might be "10.10.10.10" and the destination port might be "8001". The routing table tells the local IP router to send all packets destined for "0.0.0.0/0" to 192.168.2.1 and there is no more specific route table entry. So the packet arrives at 192.168.2.1 (the SNAT) with a destination IP of 10.10.10.10 and destination port of 8001. If that happens, I want the NAT to send the packet out on 126.96.36.199:r with a destination of 10.10.10.10:80 (the 188.8.131.52 would obviously have to be defined in a mapping and should be based on the original destination port of 8001).
I think this would be relatively trivial with iptables if it weren't for the requirement to change the destination port - but that wrinkle throws me for a loop.
How can I achieve this?