Share your knowledge at the LQ Wiki.
Go Back > Forums > Linux Forums > Linux - Networking
User Name
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.


  Search this Thread
Old 10-19-2015, 08:42 PM   #1
LQ Newbie
Registered: Oct 2015
Posts: 2

Rep: Reputation: Disabled
IPtables nat/snat over a linux router


Let me start by saying I am comfortable with Linux but lost on iptables...

I am trying to learn how to run some iptables rules over an IPSEC vpn.
My configuration is the following:

Host1/eth0 <---> eth0/Linux-VPN_Client/usb1(cellular USB) <---> ASA_Firewall <---> Turnkey_Linux

The Linux-VPN_Client is a box with 2 interfaces. One is the eth0 link back to Host1, and the other is usb1, a USB cellular link.

The VPN software is Strong Swan.

When the VPN link is up and connected over the cellular link, I can ping and ssh from the Linux-VPN_Client to the Turnkey_Linux box over the VPN.

What I want to do is to get the Client1 ip address NATed (SNAT?) to go over the VPN through the Linux-VPN_Client. Get to the web server running on the Turnkey_Linux box and see the web page on Host1.

I have made a similar configuration work using a usb ethernet device and no VPN using iptables but the rules I made and have made since do not work when I run them in the VPN configuration.

The ip_forward is already set to 1 (this seems to be a common issues from what I have read...)

Any guidance or information on what I can try or where I can read up on the correct way to do this would be greatly appreciated.

Old 10-20-2015, 01:52 PM   #2
Senior Member
Registered: Dec 2003
Location: The Key Stone State
Distribution: CentOS Sabayon and now Gentoo
Posts: 1,249
Blog Entries: 3

Rep: Reputation: 194Reputation: 194
You are going to have to make changes to your rules to reflect the USB1 interface. Normally you can se your network interface with ifconfig.
Old 11-03-2015, 09:49 AM   #3
LQ Newbie
Registered: Oct 2015
Posts: 2

Original Poster
Rep: Reputation: Disabled
Thanks for the reply lazydog.
You have confirmed all the things I needed to know. Everything I have read said the same thing you did, it should work with the correctly named interface's in the rules.
My issue was two things, my VPN software was not what I thought it was and did not deal with NATing at all. When I changed the software out I could make the following rules work:

iptables -t nat -A PREROUTING -d -j DNAT --to-destination
iptables -t nat -A POSTROUTING -d -j SNAT --to

The second issue I had is that the --to (dummy0) address is DHCP so I used the MASQUERADE option but that gave me the interface IP of the usb1 link not the VPN interface for dummy0. The rules work as long I put the correct ip address in the rule. I also find that i can not put the dummy0 interface in name is as an option in the rules. It does not work for some reason.

What I have gotten to work is this little script:

DUMMY0IP=`ifconfig dummy0 | grep "inet" | awk '{print $2}' |awk 'NR==1' | cut -d':' -f2
iptables -t nat -A PREROUTING -d -j DNAT --to-destination
iptables -t nat -A POSTROUTING -d -j SNAT --to $DUMMY0IP

Now my whole path works. If you think there is a better way to put these rules together I would like to learn it.


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
Iptables Firewall Router Nat Problems Aps Linux - Networking 5 07-28-2006 03:49 AM
NAT/router iptables script don_wombat Linux - Networking 9 09-16-2005 10:11 AM
iptables, nat, dhcp with adsl modem/router and wireless AP gjhicks Linux - Wireless Networking 8 05-16-2005 06:15 AM
NAT, IPtables, Router, and Windoze AWyant Linux - Networking 6 09-24-2003 12:30 PM > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 04:17 PM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration