Hello,

For iptables, I have the following topology with 2 physical interfaces: eth0(WAN) and eth1(LAN). Also I added some virtual interfaces to support additional ip addresses.


WAN ---- eth0 (110.120.130.140/24) ---- eth1 (10.20.30.40/24) ---- 1.2.3.4/24
---- eth0:1 (110.120.130.141/24) ---- eth1:1 (10.20.30.41/24)
---- eth0:2 (110.120.130.142/24) ---- eth1:2 (10.20.30.42/24)



Currently I have the following iptables with the translation path taken.

-A PREROUTING -d 110.120.130.140 -p tcp -m tcp --dport 80 -j DNAT --to-destination 1.2.3.4:80
-A PREROUTING -d 110.120.130.141 -p tcp -m tcp --dport 80 -j DNAT --to-destination 1.2.3.4:80
-A PREROUTING -d 110.120.130.142 -p tcp -m tcp --dport 80 -j DNAT --to-destination 1.2.3.4:80
-A POSTROUTING -d 1.2.3.4 -j MASQUERADE

110.120.130.140 -> 10.20.30.40 -> 1.2.3.4
110.120.130.141 -> 10.20.30.40 -> 1.2.3.4
110.120.130.142 -> 10.20.30.40 -> 1.2.3.4


I want to do the NAT based on the below paths instead, so that the device (1.2.3.4) will see packets coming from different source ip.

110.120.130.140 -> 10.20.30.40 -> 1.2.3.4
110.120.130.141 -> 10.20.30.41 -> 1.2.3.4
110.120.130.142 -> 10.20.30.42 -> 1.2.3.4


What else should be added to the iptables?

Thanks

Your iptables is only changing the destination address, not the source address. Try SNAT.

I dont know why you added more virtual WAN interfaces. What i know is on the destination side you can round robin the IPs .eg. To DNAT to 4 ip address (1.2.3.4, 1.2.3.5, 1.2.3.6, 1.2.3.7) instead of one (1.2.3.4) you can write the following IPtbales rule

You can try on the Wan side. means Did you tried the following rule?
May be helpful for you