From: Joelly Alexander <alex@joelly.net>
To: netfilter@vger.kernel.org
Subject: unable to source and destination nat at the same time on multi-homed server
Date: Sun, 07 Nov 2010 16:24:54 +0100 [thread overview]
Message-ID: <4CD6C4C6.3050508@joelly.net> (raw)
i am not able to do source and destination nat for local outgoing packets;
what i need:
there are two instances of software running on the same server, both
instances send traffic to the same destination ip's;
the destination ip's must see the traffic from different source ip's for
each instance;
what i tried:
the server has both ip's in the same subnet (one physical and one
virtual), but the ip-stack sends traffic out always with the lowest ip
which works for the first instance - but i need to manipulate the
traffic for the second instance;
so, my plan was to send the traffic from the second instance to a false
destination and perform source-nat to the virtual-ip and destination-nat
not to the real destination - which seems not to work;
it is not possible to perform source-nat and destination-nat in the same
rule, and on the output chain i can only perform destination-nat where i
afterwards cannot do source-nat in the postrouting chain;
i need that in the reverse order - first source-nat and then
destination-nat to have the destination ip (the temp. false one) as a
matching criteria;
in other words - source-nat must be done before destination-nat, but
iptables does not allow this because the output chain with
destination-nat is handled before the source-nat from the postrouting
chain;
does anyone know a way to solve this?
thx,
alex
next reply other threads:[~2010-11-07 15:24 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-11-07 15:24 Joelly Alexander [this message]
2010-11-07 16:10 ` unable to source and destination nat at the same time on multi-homed server Pascal Hambourg
2010-11-10 22:33 ` Joelly Alexander
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4CD6C4C6.3050508@joelly.net \
--to=alex@joelly.net \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.