Source NAT

Source NAT

[Michael Forrest]

Has anyone tried using source nat with multicast packets? Basically, I have
incoming multicast groups on one network interface and I want the packets to
appear as though they came from another interface. Is this possible using an
iptables module or something in patch-o-matic?

I've previously managed to do this via some code hacking of an iptables
module and would prefer a more reliable and longer term solution.

Any suggestions appreciated,

Michael.

 

Source NAT

[Jimmy]

Hello,

I currently have a situation that I am hoping iptables can resolve. The
issue is that I need to NAT the source address based on the destination
address. Is that possible with IPTables ?

For example

if dst = 1.1.1.1 src = 10.1.1.1
if dst = 1.1.2.1 src = 10.1.1.2

Can anyone give me any advice on completing that?

Regards,

Re: Source NAT

[Stéphane BENOLIEL]

[-- Attachment #1: Type: text/plain, Size: 487 bytes --]

Jimmy wrote:

>Hello,
>
>I currently have a situation that I am hoping iptables can resolve. The
>issue is that I need to NAT the source address based on the destination
>address. Is that possible with IPTables ?
>
>For example
>
>if dst = 1.1.1.1 src = 10.1.1.1
>if dst = 1.1.2.1 src = 10.1.1.2
>  
>
You can use DNAT
for exemple:

iptables -t nat -A PREROUTING -s 1.1.1.1 -j DNAT  --to-destination10.1.1.1

>Can anyone give me any advice on completing that?
>
>Regards,
>
>
>
>
>  
>

Re: Source NAT

[Stéphane BENOLIEL]

[-- Attachment #1: Type: text/plain, Size: 723 bytes --]

Stéphane BENOLIEL wrote:

> Jimmy wrote:
>
>> Hello,
>>
>> I currently have a situation that I am hoping iptables can resolve. The
>> issue is that I need to NAT the source address based on the destination
>> address. Is that possible with IPTables ?
>>
>> For example
>>
>> if dst = 1.1.1.1 src = 10.1.1.1
>> if dst = 1.1.2.1 src = 10.1.1.2
>>  
>>
> You can use DNAT
> for exemple:
>
> iptables -t nat -A PREROUTING -s 1.1.1.1 -j DNAT  
> --to-destination10.1.1.1
>

sorry.... mistmach...... the good solution is :

iptables -t nat -A PREROUTING -d 1.1.1.1 -j DNAT  --to-destination10.1.1.1

>> Can anyone give me any advice on completing that?
>>
>> Regards,
>>
>>
>>
>>
>>  
>>
>

Re: Source NAT

[/dev/rob0]

On Wednesday 2005-August-31 06:18, Jimmy wrote:
> I currently have a situation that I am hoping iptables can resolve.
> The issue is that I need to NAT the source address based on the
> destination address. Is that possible with IPTables ?

Trivial.

> if dst = 1.1.1.1 src = 10.1.1.1

iptables -vt nat -A POSTROUTING -d 1.1.1.1 -j SNAT -to 10.1.1.1

> Can anyone give me any advice on completing that?

"man iptables"

Order matters. If you have a catchall SNAT rule before the specific 
destination ones, the catchall is the one used.

NAT != routing. If your SNAT'ed IP addresses need to go out different 
interfaces, this won't work. See the LARTC HOWTO.
-- 
    mail to this address is discarded unless "/dev/rob0"
    or "not-spam" is in Subject: header

Re: Source NAT

[ISC Jorge Ceron Galvan]

-----Original Message-----
From: /dev/rob0 <rob0@gmx.co.uk>
To: netfilter@lists.netfilter.org
Date: Wed, 31 Aug 2005 06:37:33 -0500
Subject: Re: Source NAT

> On Wednesday 2005-August-31 06:18, Jimmy wrote:
> > I currently have a situation that I am hoping iptables can resolve.
> > The issue is that I need to NAT the source address based on the
> > destination address. Is that possible with IPTables ?
> 
> Trivial.
> 
> > if dst = 1.1.1.1 src = 10.1.1.1
> 
> iptables -vt nat -A POSTROUTING -d 1.1.1.1 -j SNAT -to 10.1.1.1


why -vt?  

this rule confused me, I'm a begginer;  

what about

iptables -t nat -A POSTROUTING -s 10.1.1.1/24 -j SNAT --to 1.1.1.1

or

iptables -t nat -A POSTROUTING -o eth0 -s 10.1.1.1/24 -j SNAT --to 1.1.1.1


> 
> > Can anyone give me any advice on completing that?
> 
> "man iptables"
> 
> Order matters. If you have a catchall SNAT rule before the specific 
> destination ones, the catchall is the one used.
> 
> NAT != routing. If your SNAT'ed IP addresses need to go out different
> interfaces, this won't work. See the LARTC HOWTO.
> -- 
>     mail to this address is discarded unless "/dev/rob0"
>     or "not-spam" is in Subject: header

Re: Source NAT

[/dev/rob0]

On Saturday 2005-September-03 14:28, ISC Jorge Ceron Galvan wrote:
> > > I currently have a situation that I am hoping iptables can
> > > resolve. The issue is that I need to NAT the source address based
> > > on the destination address. Is that possible with IPTables ?
> >
> > Trivial.
> >
> > > if dst = 1.1.1.1 src = 10.1.1.1
> >
> > iptables -vt nat -A POSTROUTING -d 1.1.1.1 -j SNAT -to 10.1.1.1
>
> why -vt?
>
> this rule confused me, I'm a begginer;

All the more reason to RTFM, as previously suggested. Hint: the -v 
option to iptables does the same thing as does the -v option to most 
other command line programs.

> what about
>
> iptables -t nat -A POSTROUTING -s 10.1.1.1/24 -j SNAT --to 1.1.1.1

This is not what the OP said was wanted. That is SNAT based on the 
source address, not the destination.

> iptables -t nat -A POSTROUTING -o eth0 -s 10.1.1.1/24 -j SNAT --to
> 1.1.1.1

Same thing, with the additional specification of output interface. You 
can, of course, specify more matching options to limit the packets 
selected by the rule. It *is* common to limit SNAT based upon source 
address too.

> > > Can anyone give me any advice on completing that?
> >
> > "man iptables"
> >
> > Order matters. If you have a catchall SNAT rule before the specific
> > destination ones, the catchall is the one used.
> >
> > NAT != routing. If your SNAT'ed IP addresses need to go out
> > different interfaces, this won't work. See the LARTC HOWTO.
-- 
    mail to this address is discarded unless "/dev/rob0"
    or "not-spam" is in Subject: header