Hi,

My existing network setup.

ISP Router|LAN IP (NAT by ISP) --> My LAN
203.XX.XX.XX|192.168.2.254/24 --> 192.168.2.0/24

My Requirement

ISP Router|LAN IP (NAT by ISP) --> My Linux Box With NAT --> LAN
203.XX.XX.XX|192.168.2.254/24 --> 192.168.2.231|192.168.2.232 --> 192.168.1.0/24

Point to have a such setup is

1. Monitor all the in & out traffic of the network.
2. Setup transparent proxy server for content filtering

I need your advice on below.

1. Is it possible to NAT in same IP range (192.168.2.231|192.168.2.232)
2. If not what is your recommendation for this setup
3. What is the syntax I should use to allow WAN to LAN traffic

You cannot have the same IP network in two different places, if that's what you're asking.

If I've understood you correctly, you want something like this::That should work just fine, as long at the two network interfaces on the Linux box have IP addresses in different networks.

The dual NAT setup will take care of return packets from the Internet. If you want to forward ports to hosts on the 192.168.1.0/24 network, you'd have to first forward the ports in question from the ISP router to the Linux box, and then again from the Linux box to the relevant host(s) on the 192.168.1.0/24 network.

You may want to investigate the possibility of setting the ISP router in "bridge mode", as that would allow the external NIC on the Linux box to use the public IP address currently assigned to the ISP router. Whether or not that is possible depends on your ISP and the type of Internet connection you're using.

1 members found this post helpful.

Thanks for your reply, Yes you are perfectly correct..

1. to be sure "You cannot have the same IP network in two different places, if that's what you're asking." you mean by this my linux box with two NIC's which I am planning to do the NAT MUST be in two IP Ranges. as your example.?
(192.168.2.231)[Linux box performing NAT](192.168.1.1)

2. If I use public IP for one NIC in Linux Box how will I handle the other NAT Traffic from IPS router.

Linux NAT
---------
(203.xx.xx.12) [Linux box performing NAT](192.168.1.1)| |192.168.1.0/24 network |[other clients]


ISP NAT
-------

(203.xx.xx.13)
[ISPRouter performing NAT]
(192.168.1.20)Server
(This should be able to access from Internal & Externally)
192.168.1.0/24 network

Sort of, yes.

IP addresses are grouped in networks or subnets as dictated by the network mask. For instance, a netmask of 255.255.255.0 means the first three octets of the IP address designate the network, and the last is the address of a host in that network. The same network cannot ever exist on both sides of a router.

You don't. When put in "bridge mode", the ISP router will no longer be NATing anything. Your Linux router will have to handle it instead.

1 members found this post helpful.

Thank you for your reply & explanation, it's neat & clearly explained. If I come up with more questions I will get back to you. Thank you again..!