Debian iptables – How to Create a 1:1 NAT with iptables

debianiptablesport-forwarding

I am running a Debian 10 server which has multiple network interfaces. Can I create rules that will route all network traffic coming in to one IP address on one of the interfaces from the outside (i.e. from other devices on the network), to another IP address not on the same machine but elsewhere on the network? Similarly to WAN-to-LAN routing.

I know how to do it on e.g pfSense but I am quite lost with iptables..

Non-iptables solutions are also welcome.

Best Answer

Quick examples for forwarding traffic coming from outside and interfaces within the same machine from address original to another address for ip versions 4 and 6 (possibly excluding ipsec traffic with an endpoint on the original address and existing connections at point of execution). This also does NOT redirect traffic generated by locally executing programs, for that you need the OUTPUT chain.

#Activate forwarding
#Note: These forward settings are not reboot persistent
sysctl -w net.ipv6.conf.all.forwarding=1
sysctl -w net.ipv4.ip_forward=1

iptables -t nat -A PREROUTING -d original.add.re.ss -j DNAT --to-destination ipv4.add.re.ss
iptables -t nat -A POSTROUTING -j MASQUERADE

ip6tables -t nat -A PREROUTING -d [original.add.re.ss] -j DNAT --to-destination [2001::]
ip6tables -t nat -A POSTROUTING -j MASQUERADE

If you want to limit the forwarding to only packets from outside you have to modify the rules, either add a -i interface naming the interface where they come in or match everything that did not originate from a local address -m addrtype ! --src-type LOCAL. You could further exclude broadcast and multicast traffic by using -m addrtype --dst-type UNICAST --src-type UNICAST. You should also check that the default policy for the FORWARD chain is ACCEPT or add specific rules in that chain.

Dumping the existing filter and nat tables can be done with iptables -S -t filter and iptables -S -t nat. The filter table is where you configure the FORWARD rules if there is a DROP policy.The -A before PREROUTING/POSTROUTING means Append. If you need to insert the rule, because there is a DROP at the end, you have to use -I and put a number behind the chain name.

Related Topic