LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Networking (https://www.linuxquestions.org/questions/linux-networking-3/)
-   -   NAT & Forwarding issue (https://www.linuxquestions.org/questions/linux-networking-3/nat-and-forwarding-issue-4175526341/)

nikooo777 11-24-2014 07:51 AM

NAT & Forwarding issue
 
Hello there,
I have a quite interesting issue which I can't seem to be able to crack down myself.

I have 2 machines A and B

A has 3 public ip addresses:
123.123.123.123 (eth0)
124.124.124.124 (eth0:0)
125.125.125.125 (eth0:1)

B has 1 ip address:
233.233.233.233 (eth0)

i have several services on both machines, each service runs on a different port:

machine A:
Service1 port 27015 bound to 123.123.123.123
Service2 port 27025 bound to 123.123.123.123
Service3 port 27035 bound to 123.123.123.123
Service4 port 27045 bound to 124.124.124.124
...

machine B
Service 1 port 27055
Service 2 port 27065
...

Due to reasons I am trying to forward the traffic in machine A within the machine itself and outside to machine B as following:
123.123.123.123:27045 -> 124.124.124.124:27045
123.123.123.123:27055 -> 233.233.233.233:27055

However it's not quite clear how I should do that using iptables.

my current iptables configuration is as follows (on machine A):

Quote:

...
# Completed on Sat Nov 22 18:00:43 2014
# Generated by iptables-save v1.4.14 on Sat Nov 22 18:00:43 2014
*nat
:PREROUTING ACCEPT [155:8070]
:INPUT ACCEPT [161:8388]
:OUTPUT ACCEPT [27:1568]
:POSTROUTING ACCEPT [0:0]
-A PREROUTING -p udp -m udp --dport 27045 -j DNAT --to-destination 124.124.124.124:27045
-A PREROUTING -p udp -m udp --dport 27055 -j DNAT --to-destination 233.233.233.233:28015
-A POSTROUTING -j MASQUERADE
COMMIT
# Completed on Sat Nov 22 18:00:43 2014
forwarding is activated in the kernel, so that's fine.


The issue is that with that specific set of rules, the incoming traffic is correctly forwarded, however, when I try to bind my Service2 on machine A to ip 124.124.124.124 it sees it as internal IP and uses 123.123.123.123 for outbound communications instead.
Obviously I'm trying to get the service to bind to 124.124.124.124.

I can successfully bind to the right IP if i don't add this rule:
Quote:

-A POSTROUTING -j MASQUERADE
however without that rule, NAT doesn't work.

Do you guys know what i should do in order for this to work?

Greetings,
Nikooo777

smallpond 11-24-2014 10:20 AM

If you have a static IP, you should use SNAT instead of MASQUERADE and specify the interface where you want source nat to apply.


All times are GMT -5. The time now is 07:01 AM.