Iptables – Postrouting rule in NAT table

iptablesnat;

I have a strange question regarding NAT using iptables.

When I do SNAT in a postrouting chain in NAT table at the end of the rule should I give -J ACCEPT?

I see counters on the postrouting rule getting incremented but no packet leaving the machine.
So does it mean the packet is DROPPED automatically?

Best Answer

No. There is only one target (-j) per rule. The -j SNAT is exclusive, you can't provide two targets for a rule. If you need to accept the packet, the 'ACCEPT' target should be used in the 'FORWARD' chain of the 'filter' table.

Packets are only dropped if there is a rule to drop them, or if the default policy of the 'FORWARD' chain is 'DROP'. In both case, these counters are updated.

More likely, routing is not enabled or your routing tables are not complete.

To enable routing:

sysctl net.ipv4.ip_forward=1

Related Solutions

Iptables – NAT and iptables

If I understand your question well, Box 2 is in a VLAN with Box 1, and Box 1 is in another VLAN as well which has access to the Internet.

Assuming the first VLAN is e.g. VLAN 100 and the second VLAN is VLAN 200, I assume you configured VLANs correctly on Box 1 and thus you have two network interfaces for the two VLANs (typically eth0.100 and eth0.200).

In this case the solution is simple, on Box 1:

iptables -t nat -A POSTROUTING -o eth0.200 -j MASQUERADE

With this command Box 1 will NAT-masquerade packets to the Internet on VLAN 200. Thus when Box 2 will send packets to Box 1 on VLAN 100, Box 1 will forward them to VLAN 200.

Make sure IP forwarding is enabled on Box 1 (sysctl -w net.ipv4.ip_forward=1).

Iptables and SNAT

Remove the three rules you have above and try adding this:

$IPTABLES -t NAT -A POSTROUTING -s 192.x.y.a -j SNAT 192.x.y.b
$IPTABLES -A FORWARD -s 192.x.y.a -J ACCEPT

And enter the following command:

echo 1 > /proc/sys/net/ipv4/ip_forward

You should also have a rule similar to the following in your firewall:

$IPTABLES -t FILTER -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

That will take care of all established/related connections, instead of making a rule for each one.

Best Answer

Related Solutions

Iptables – NAT and iptables

Iptables and SNAT

Related Topic