| View previous topic :: View next topic |
| Author |
Message |
ceicke
n00b
Joined: 20 Jul 2006
Posts: 23
Location: DE, Hamburg
|
 Posted: Wed Apr 29, 2009 12:44 pm Post subject: IPTables NAT |
 |
|
Hi,
I have the following problem that I can't seem to fix.
I have two networks at hand: 192.168.2.0/24 and 192.168.4.0/24. Between the two networks I would like to do some sort of NATing, so that in network 192.168.2.0/24, host 192.168.4.X appears as 192.168.2.X and vice verca.
Unfortunately, SNAT doesn't allow the following thing:
| Code: | | iptables -t nat -A POSTROUTING -o eth0 -s 192.168.2.0/24 -j SNAT --to 192.168.4.0/24 |
Am I missing something? Is there a completely obvious way to do this?
Thanks,
Christoph |
|
| Back to top |
|
 |
xtz
Apprentice
Joined: 29 Oct 2007
Posts: 181
Location: Singapore
|
| Posted: Wed Apr 29, 2009 1:09 pm Post subject: |
|
|
| If you just want the two networks to be able to access each other, enable the IP forwarding in /etc/sysctl.conf |
|
| Back to top |
|
|
ceicke
n00b
Joined: 20 Jul 2006
Posts: 23
Location: DE, Hamburg
|
| Posted: Wed Apr 29, 2009 1:28 pm Post subject: |
|
|
| Well, of course that's what I want and that's happening already. At this point I'm doing masquerading, but let me stress this point again: I specifically want this IP mapping and not in the way that everything appears to come from one IP (which is happening in the case of doing masquerading). |
|
| Back to top |
|
|
szmytson
n00b
Joined: 29 Apr 2009
Posts: 20
Location: UK
|
| Posted: Wed Apr 29, 2009 1:37 pm Post subject: Re: IPTables NAT |
|
|
Hi,
I guess there is no smart way to achieve this...
The manual way would be something like this:
| Code: | | perl -e 'foreach $i (1..254) {print "iptables -t nat -A POSTROUTING -o eth0 -s 192.168.2.$i -j SNAT --to 192.168.4.$i" . "\n";}' |
|
|
| Back to top |
|
|
xtz
Apprentice
Joined: 29 Oct 2007
Posts: 181
Location: Singapore
|
| Posted: Wed Apr 29, 2009 2:05 pm Post subject: |
|
|
| AFAIK, u cannot SNAT a whole network just like this. I think a single rule is needed to SNAT from each separate address to anothe separate one. |
|
| Back to top |
|
|
Mad Merlin
Veteran
Joined: 09 May 2005
Posts: 1155
|
| Posted: Thu Apr 30, 2009 1:24 am Post subject: |
|
|
Is there a reason you're not just using a 192.168.0.0/16 network? Then all machines could talk directly to eachother.
Anyways, with the NETMAP target I think you can do what you're hoping for:
| Code: |
NETMAP
This target allows you to statically map a whole network of addresses
onto another network of addresses. It can only be used from rules in
the nat table.
--to address[/mask]
Network address to map to. The resulting address will be con-
structed in the following way: All 'one' bits in the mask are
filled in from the new `address'. All bits that are zero in the
mask are filled in from the original address.
|
_________________
Game! - Where the stick is mightier than the sword! |
|
| Back to top |
|
|
|
Networking & Security
