NAT question

NAT question

[Stephen Clark]

Can iptables do a network to network nat without having to write out a 
bunch of nat rules.
In other words translate  192.168.198.0/24 to 172.16.10.0/24 without 
having to write out
256 rules.

Also can iptables handle 1000 nat rules like above if they have to be 
written out on
a 1.66ghz intel dual core atom with 1gb of mem.

I know this isn't appropriate question for devel list but I didn't find 
anything googling.

Thanks,

-- 

"They that give up essential liberty to obtain temporary safety,
deserve neither liberty nor safety."  (Ben Franklin)

"The course of history shows that as a government grows, liberty
decreases."  (Thomas Jefferson)

Re: NAT question

[richard -rw- weinberger]

On Wed, Jan 25, 2012 at 4:54 PM, Stephen Clark <sclark46@earthlink.net> wrote:
> Can iptables do a network to network nat without having to write out a bunch
> of nat rules.
> In other words translate  192.168.198.0/24 to 172.16.10.0/24 without having
> to write out
> 256 rules.
>

Maybe the NETMAP target is the right thing for you.

-- 
Thanks,
//richard

Re: NAT question

[Eric Dumazet]

Le mercredi 25 janvier 2012 à 10:54 -0500, Stephen Clark a écrit :
> Can iptables do a network to network nat without having to write out a 
> bunch of nat rules.
> In other words translate  192.168.198.0/24 to 172.16.10.0/24 without 
> having to write out
> 256 rules.
> 
> Also can iptables handle 1000 nat rules like above if they have to be 
> written out on
> a 1.66ghz intel dual core atom with 1gb of mem.
> 
> I know this isn't appropriate question for devel list but I didn't find 
> anything googling.
> 
> Thanks,
> 

If you are forced to use 256 rules, you could split them into 16 tables
of 16 rules and do a hash split.

Since these rules are run only for new connections, it might be OK
performance wise, depending on rate of connection establishment.

If not, you can try NETMAP :)

# iptables -t nat -A POSTROUTING -s 192.168.198.0/24 -j NETMAP --to 172.16.10.0/24

# iptables -t nat -nvL POSTROUTING
Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 NETMAP     all  --  *      *       192.168.198.0/24     0.0.0.0/0           172.16.10.0/24

Re: NAT question

[Stephen Clark]

On 01/25/2012 11:52 AM, Eric Dumazet wrote:
> Le mercredi 25 janvier 2012 à 10:54 -0500, Stephen Clark a écrit :
>    
>> Can iptables do a network to network nat without having to write out a
>> bunch of nat rules.
>> In other words translate  192.168.198.0/24 to 172.16.10.0/24 without
>> having to write out
>> 256 rules.
>>
>> Also can iptables handle 1000 nat rules like above if they have to be
>> written out on
>> a 1.66ghz intel dual core atom with 1gb of mem.
>>
>> I know this isn't appropriate question for devel list but I didn't find
>> anything googling.
>>
>> Thanks,
>>
>>      
> If you are forced to use 256 rules, you could split them into 16 tables
> of 16 rules and do a hash split.
>
> Since these rules are run only for new connections, it might be OK
> performance wise, depending on rate of connection establishment.
>
> If not, you can try NETMAP :)
>
> # iptables -t nat -A POSTROUTING -s 192.168.198.0/24 -j NETMAP --to 172.16.10.0/24
>
> # iptables -t nat -nvL POSTROUTING
> Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
>   pkts bytes target     prot opt in     out     source               destination
>      0     0 NETMAP     all  --  *      *       192.168.198.0/24     0.0.0.0/0           172.16.10.0/24
>
>    
Thanks Eric,

I assume I need an additional rule like this to translate in the other 
direction?
iptables -t nat -A POSTROUTING -s 172.16.10.0/24 -j NETMAP --to 
198.168.198.0/24

iptables -t nat -nvL POSTROUTING
Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
  pkts bytes target     prot opt in     out     source               
destination

    15  2535 NETMAP     all  --  *      *       192.168.198.0/24     
0.0.0.0/0           172.16.10.0/24
     0     0 NETMAP     all  --  *      *       172.16.10.0/24       
0.0.0.0/0           198.168.198.0/24


Also now that I am clued to NETMAP I found this example:
iptables -t mangle -A PREROUTING -s 192.168.1.0/24 -j NETMAP --to 
10.5.6.0/24

using mangle and PREROUTING - does it matter?

"They that give up essential liberty to obtain temporary safety,
deserve neither liberty nor safety."  (Ben Franklin)

"The course of history shows that as a government grows, liberty
decreases."  (Thomas Jefferson)