[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

problem with iptables nat II


because some people didn't understand our problems, here again:

Wintel computer with actual sarge 2.6.8-2 and actual iptables,

three network interfaces
net one:
net two:
net three:

net one is the internal, net two the dmz. net three the internet.

We like to do some double natting of our dmz machines:

The (internal) IP of one dmz computer may be
The IP from the intranet should be
The IP from the internet should be

Simple 1:1 static natting, but route dependend. Easily done by iproute2.
No more longer possible because the kernel was changed and nat by ip route/rule isn't possible anymore.

We got several manuals like NAT HOWTO or iptables from LeRoy D. Cressy or double nat HOWTO.
Most of them deal with port forwarding or masquerading. Nice, but this did not help.
NETMAP could be an possibility, but Cressy points out that connection tracking didn't work well (whatever this means).
I googled NETMAP, but still now I didn't find some real good advertisement about this.
And no, I'm not so good to take the sources of iptable & patches and learn about all circumstances by miself, soory.
In our test environment, this didn't work out:

| # NAT
| #
| iptables -t nat -A POSTROUTING -s -o eth0 -j SNAT --to
| iptables -t nat -A PREROUTING -i eth1 -d -j DNAT --to


Dr. Günter Sprakties

Reply to: