Linux – Iptables NAT logging

Have you looked into Smoothwall. I set it up at home on a very old machine. I let it handle DHCP also.

I like it for the stats and because its sort of a 'project' for me.

Edit: to be more clear, there are several different possible configurations. I am running all traffic, including a wireless router though my Smoothwall machine. Internet comes into my cable modem and goes straight to the Smoothwall box, then out to an 8-port switch. From there it goes to a wireless router and to a few wired machines. I can monitor traffic/bandwidth in real time and/or look at history in graph or text form. I am still a newbie, but am having a great time with it.

Another Edit: I am not sure this would be appropriate for a huge network and, after rereading the question, I am not sure it is what you are looking for, but I am leaving it up for the info.

To my knowledge, the address rewriting behaviour you're describing will happen so long as the outbound response packet is routed by the same router that routed / DNAT'ed the incoming request. If any other of the N+1 routers in the highly-available router pool are handling the outbound response packet, though, they're not going to "see" that connection in the Netfilter state database.

It sounds like you want a highly available Netfilter router that shares NAT state machine information. The ct_sync tool mentioned in that paper has been mostly abandoned, but the conntrackd tool from conntrack-tools has been developed to do some of the same things as ct_sync.

If you're planning on doing stateful packet filtering (or NAT, which is really just a superset of stateful packet filtering) then you're going to need a method to distribute the state database (or, alternatively, go with stateless filtering in the network and do stateful filtering on each host).