unable to source and destination nat at the same time on multi-homed server

unable to source and destination nat at the same time on multi-homed server

[Joelly Alexander]

i am not able to do source and destination nat for local outgoing packets;

what i need:

there are two instances of software running on the same server, both 
instances send traffic to the same destination ip's;
the destination ip's must see the traffic from different source ip's for 
each instance;

what i tried:

the server has both ip's in the same subnet (one physical and one 
virtual), but the ip-stack sends traffic out always with the lowest ip 
which works for the first instance - but i need to manipulate the 
traffic for the second instance;

so, my plan was to send the traffic from the second instance to a false 
destination and perform source-nat to the virtual-ip and destination-nat 
not to the real destination  - which seems not to work;

it is not possible to perform source-nat and destination-nat in the same 
rule, and on the output chain i can only perform destination-nat where i 
afterwards cannot do source-nat in the postrouting chain;

i need that in the reverse order - first source-nat and then 
destination-nat to have the destination ip (the temp. false one) as a 
matching criteria;

in other words - source-nat must be done before destination-nat, but 
iptables does not allow this because the output chain with 
destination-nat is handled before the source-nat from the postrouting 
chain;

does anyone know a way to solve this?

thx,
alex

Re: unable to source and destination nat at the same time on multi-homed server

[Pascal Hambourg]

Joelly Alexander a écrit :
> 
> in other words - source-nat must be done before destination-nat, but 
> iptables does not allow this because the output chain with 
> destination-nat is handled before the source-nat from the postrouting 
> chain;
> 
> does anyone know a way to solve this?

You can mark the packets (-j MARK) or the connection (-j CONNMARK) in
mangle/OUTPUT before DNAT, and match the packet mark (-m mark) or
connection mark (-m connmark) in nat/POSTROUTING.

Or you can use -m conntrack --ctorigdst to match the original
destination address.

Re: unable to source and destination nat at the same time on multi-homed server

[Joelly Alexander]

On 07.11.2010 17:10, Pascal Hambourg wrote:does anyone know a way to 
solve this
> You can mark the packets (-j MARK) or the connection (-j CONNMARK) in
> mangle/OUTPUT before DNAT, and match the packet mark (-m mark) or
> connection mark (-m connmark) in nat/POSTROUTING.
>
> Or you can use -m conntrack --ctorigdst to match the original
> destination address.
>
After playing around some time to see how to use and how it works - it 
does exactly what i need

Thanks