How would you go about the following: NAT

Note: Internet access should work at all times using the classic MASQUERADE action in the nat table's POSTROUTING chain.

Now the challenge:

  • for all connections accessing the router (middle) from the outside (right) on a certain port (1)
  • send those requests to the inside host (left) while making it appear the request came from the router (middle) (2)
  • for the reply (3&4) inverse that process.

I don't know how you would call that specific method to NAT, and I don't know if it's possible at all (or with netfilter).

(Don't ask why. But if you do: it's got to do with the routing table at the host, which doesn't have the default route on the interface that I'm showing here, yet I'd like to have it available from anywhere, and I believe this is the only way to do it; by mapping the internet access to a connection/network that is directly attached, therefore overriding the routing table. I hope.)

And remember: Internet access should keep working using classic masquerading.


So you have no default gateway on, and presumably cannot specify one. So traffic outgoing from here to random hosts on the Internet will not know where to go.

I think the way to go about what you want to do purely in iptables is to set up a second NAT between and

It's probably going to be easier and less of a headache to do something like a proxy or VPN tunnel if possible.

Going the VPN route - On, run an OpenVPN server, creating a virtual "tun0" interface. Setup a client that connects to it on - this will also set up a virtual "tun0" on its side.

You'll then put these virtual interfaces on their own network (like "tun0" on the server side will default to, and the other side will likely default to - but you can use a "client configuration directive" to assign it a fixed IP. Tell any services needing to be visible on the Internet to listen on A simple REDIRECT target in your PREROUTING table ought to make a specific port redirect to

To address performance concerns, if you aren't concerned about security on your LAN, you don't have to enable encryption - and you can set the authentication to be a password which you include in a boot script (though you do need a server cert at the very least) and just have it be a straight tunnel.

You might also be able to get a LAN side "internal only" proxy to work in this situation if your service can be put behind one.

| improve this answer | |
  • Can't install random stuff on the device -- it's custom. Although the device is pure Linux. Can do anything with that. Hell, I think I'll just install a reverse proxy on – Marki Nov 4 '13 at 20:17
  • Argh, reverse proxying an SSL backend (with an SSL frontend) seems to be complicated if at all possible. – Marki Nov 5 '13 at 13:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.