source nat does'nt work in bridge mode

source nat does'nt work in bridge mode

[afshin lamei]

dear all, I've a linux box with iptables which is working in bridge
mode. I want to change (NAT) the source IP of the outging packets,
using:
iptables -t nat -A POSTROUTING -s 192.168.100.100 -j SNAT --to-source
192.168.100.1
the rule works correctly (source nat is done), but the client
(192.168.100.100) does not revieve any packet of the reply. sniffing
the outgoing traffic shows that the next hop can not find the client
with translated IP (192.168.100.1). what should I do?
regards
afshin

Re: source nat does'nt work in bridge mode

[Martijn Lievaart]

afshin lamei zei:
> dear all, I've a linux box with iptables which is working in bridge
> mode. I want to change (NAT) the source IP of the outging packets,
> using:
> iptables -t nat -A POSTROUTING -s 192.168.100.100 -j SNAT --to-source
> 192.168.100.1
> the rule works correctly (source nat is done), but the client
> (192.168.100.100) does not revieve any packet of the reply. sniffing the
> outgoing traffic shows that the next hop can not find the client with
> translated IP (192.168.100.1). what should I do?

Create a static arp entry on the firewall for 192.168.100.1 so the packets
can find their way back to the firewall. Remember, 192.168.100.1 does not
"exist" so we have to fake it in order for the arp protocol to work.

HTH,
M4

Re: source nat does'nt work in bridge mode

[Chinh Nguyen]

afshin lamei wrote:
> dear all, I've a linux box with iptables which is working in bridge
> mode. I want to change (NAT) the source IP of the outging packets,
> using:
> iptables -t nat -A POSTROUTING -s 192.168.100.100 -j SNAT --to-source
> 192.168.100.1
> the rule works correctly (source nat is done), but the client
> (192.168.100.100) does not revieve any packet of the reply. sniffing
> the outgoing traffic shows that the next hop can not find the client
> with translated IP (192.168.100.1). what should I do?
> regards
> afshin
> 

How can 100 receive the reply? Supposing you send a packet to 101. Because of
SNAT, 101 receives the packet from 1. When it tries to send the reply back, as 1
is on the same subnet, 101 will attempt to ARP the MAC address of 1. Since there
is no such machine, the reply is not sent out. (Note that if there is a 1
machine, the reply will go to it and still not to 100).

You might be able to solve this by adding an alias to your interface. For
example, "ip addr add 192.168.100.1/24 dev eth0". In this case, your 100 machine
may respond to an ARP request of 192.168.100.1.