LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 11-24-2014, 07:51 AM   #1
nikooo777
LQ Newbie
 
Registered: Apr 2010
Location: Switzerland
Distribution: Debian Squeeze
Posts: 15

Rep: Reputation: 0
NAT & Forwarding issue


Hello there,
I have a quite interesting issue which I can't seem to be able to crack down myself.

I have 2 machines A and B

A has 3 public ip addresses:
123.123.123.123 (eth0)
124.124.124.124 (eth0:0)
125.125.125.125 (eth0:1)

B has 1 ip address:
233.233.233.233 (eth0)

i have several services on both machines, each service runs on a different port:

machine A:
Service1 port 27015 bound to 123.123.123.123
Service2 port 27025 bound to 123.123.123.123
Service3 port 27035 bound to 123.123.123.123
Service4 port 27045 bound to 124.124.124.124
...

machine B
Service 1 port 27055
Service 2 port 27065
...

Due to reasons I am trying to forward the traffic in machine A within the machine itself and outside to machine B as following:
123.123.123.123:27045 -> 124.124.124.124:27045
123.123.123.123:27055 -> 233.233.233.233:27055

However it's not quite clear how I should do that using iptables.

my current iptables configuration is as follows (on machine A):

Quote:
...
# Completed on Sat Nov 22 18:00:43 2014
# Generated by iptables-save v1.4.14 on Sat Nov 22 18:00:43 2014
*nat
:PREROUTING ACCEPT [155:8070]
:INPUT ACCEPT [161:8388]
:OUTPUT ACCEPT [27:1568]
:POSTROUTING ACCEPT [0:0]
-A PREROUTING -p udp -m udp --dport 27045 -j DNAT --to-destination 124.124.124.124:27045
-A PREROUTING -p udp -m udp --dport 27055 -j DNAT --to-destination 233.233.233.233:28015
-A POSTROUTING -j MASQUERADE
COMMIT
# Completed on Sat Nov 22 18:00:43 2014
forwarding is activated in the kernel, so that's fine.


The issue is that with that specific set of rules, the incoming traffic is correctly forwarded, however, when I try to bind my Service2 on machine A to ip 124.124.124.124 it sees it as internal IP and uses 123.123.123.123 for outbound communications instead.
Obviously I'm trying to get the service to bind to 124.124.124.124.

I can successfully bind to the right IP if i don't add this rule:
Quote:
-A POSTROUTING -j MASQUERADE
however without that rule, NAT doesn't work.

Do you guys know what i should do in order for this to work?

Greetings,
Nikooo777
 
Old 11-24-2014, 10:20 AM   #2
smallpond
Senior Member
 
Registered: Feb 2011
Location: Massachusetts, USA
Distribution: Fedora
Posts: 4,147

Rep: Reputation: 1264Reputation: 1264Reputation: 1264Reputation: 1264Reputation: 1264Reputation: 1264Reputation: 1264Reputation: 1264Reputation: 1264
If you have a static IP, you should use SNAT instead of MASQUERADE and specify the interface where you want source nat to apply.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Port forwarding & NAT linuxhasib Linux - Server 1 02-08-2012 01:00 AM
NAT Forwarding Issue (SYN_SENT) mboudro Linux - Networking 2 07-02-2010 10:58 AM
NAT and Port Forwarding aq_mishu Linux - Networking 2 09-16-2005 07:58 AM
NAT forwarding kermitthefrog91 Linux - Networking 4 08-04-2005 03:26 AM
NAT'ing RC.FIREWALL Script & Port Forwarding Bittorrent wlfdgcrkz Linux - Networking 2 08-24-2004 10:08 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 08:28 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration