NAT and IPSEC

NAT and IPSEC

[Stephen Clark]

Hello,

I have to separate ipsec tunnels going to two different private networks. How do 
I keep iptables from natting the traffic destined for these 2 networks. I tried:

iptables -t nat -A POSTROUTING -o eth1 -d ! 192.168.1.0/24  -d ! 172.16.0.0/16 
-j MASQUERADE

but it says only one -d is allowed. So I tried
iptables -t nat -A POSTROUTING -o eth1 -d ! ( 192.168.1.0/24 || 172.16.0.0/16 ) 
-j MASQUERADE

and it says "(" error. So how do I specify multiple destination 
networks/addresses to be excluded from being natted.

Thanks,
Steve

-- 

"They that give up essential liberty to obtain temporary safety,
deserve neither liberty nor safety."  (Ben Franklin)

"The course of history shows that as a government grows, liberty
decreases."  (Thomas Jefferson)

Re: NAT and IPSEC

[Jan Engelhardt]

On Thursday 2009-04-16 15:00, Stephen Clark wrote:

> Hello,
>
> I have to separate ipsec tunnels going to two different private networks. How
> do I keep iptables from natting the traffic destined for these 2 networks. I
> tried:
>
> iptables -t nat -A POSTROUTING -o eth1 -d ! 192.168.1.0/24  -d ! 172.16.0.0/16
> -j MASQUERADE
>
> but it says only one -d is allowed. So I tried

Create a new chain from which you prematurely exit if the daddr is 
192.168.1.0/24 or 172.16.0.0/16, and the third rule would masq.

> iptables -t nat -A POSTROUTING -o eth1 -d ! ( 192.168.1.0/24 || 172.16.0.0/16 )
> -j MASQUERADE
>
> and it says "(" error. So how do I specify multiple destination
> networks/addresses to be excluded from being natted.