All of lore.kernel.org
 help / color / mirror / Atom feed
From: Joelly Alexander <alex@joelly.net>
To: netfilter@vger.kernel.org
Subject: unable to source and destination nat at the same time on multi-homed server
Date: Sun, 07 Nov 2010 16:24:54 +0100	[thread overview]
Message-ID: <4CD6C4C6.3050508@joelly.net> (raw)

i am not able to do source and destination nat for local outgoing packets;

what i need:

there are two instances of software running on the same server, both 
instances send traffic to the same destination ip's;
the destination ip's must see the traffic from different source ip's for 
each instance;

what i tried:

the server has both ip's in the same subnet (one physical and one 
virtual), but the ip-stack sends traffic out always with the lowest ip 
which works for the first instance - but i need to manipulate the 
traffic for the second instance;

so, my plan was to send the traffic from the second instance to a false 
destination and perform source-nat to the virtual-ip and destination-nat 
not to the real destination  - which seems not to work;

it is not possible to perform source-nat and destination-nat in the same 
rule, and on the output chain i can only perform destination-nat where i 
afterwards cannot do source-nat in the postrouting chain;

i need that in the reverse order - first source-nat and then 
destination-nat to have the destination ip (the temp. false one) as a 
matching criteria;

in other words - source-nat must be done before destination-nat, but 
iptables does not allow this because the output chain with 
destination-nat is handled before the source-nat from the postrouting 
chain;

does anyone know a way to solve this?

thx,
alex

             reply	other threads:[~2010-11-07 15:24 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2010-11-07 15:24 Joelly Alexander [this message]
2010-11-07 16:10 ` unable to source and destination nat at the same time on multi-homed server Pascal Hambourg
2010-11-10 22:33   ` Joelly Alexander

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=4CD6C4C6.3050508@joelly.net \
    --to=alex@joelly.net \
    --cc=netfilter@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.