Iptables – redirect outbound traffic to internal IP using iptables

iptablesrouterrouting

I am trying to use iptables to redirect outbound traffic to an external ip address as if it were inbound traffic. My setup is as follows;

         NET A          NET B      
|------|       |------|       |--|
|SERVER|<----->|DD-WRT|<----->|FW|<--> WAN
|------|   |   |------|       |--|
           |
|------|   |
| COMP |<--|
|------|

Where SERVER and COMP are both computers on network A, and DD-WRT is a router connecting networks A and B, and FW is a large firewall connecting network B to the WAN.

I have port forwards set up properly on my DD-WRT router and the large Firewall to forward packets to SERVER when external computers attempt to connect to FW. However, when COMP attempts to connect to FW, the packets are dropped because FW does not recognize that packets coming internally destined for the WAN address are meant to be routed according to the external rules.

Therefore, I would like to somehow route the packets emanating from COMP destined for FW's WAN address to appear to the DD-WRT as if they are instead destined for it's Network B address, as I know it is capable of routing these types of packets properly.

If anyone else has a better suggestion, I would of course be glad to hear it!

Best Answer

I'm guessing that you're doing NAT for traffic from NET A to NET B, in which case you'll need to add a rule to exclude traffic from NET A destined for the NET B address of the DD-WRT - something like:

iptables -t nat -I POSTROUTING -s <net.a.ip.block/mask> -d <dd-wrt.net.b.address> -j ACCEPT

or you could do a rewrite of the address like so:

iptables -t nat -I PREROUTING -s <net.a.ip.block/mask> -d <dd-wrt.net.b.address> -j DNAT --to <SERVER.net.a.address>

EDIT: Rereading the question properly you'll need a variant of the second method:

iptables -t nat -I PREROUTING -s <net.a.ip.block/mask> -d <fw.wan.add.ress> -j DNAT --to <server.net.a.address>
Related Topic