iptables internal NAT with two public IP

Thread Tools Search this Thread
Top Forums UNIX for Advanced & Expert Users iptables internal NAT with two public IP
# 1  
Old 08-03-2009
iptables internal NAT with two public IP

Hello Guys,
I have a debian machine that work as a firewall (iptables + squid 2.6) with two physical interfaces: eth0 (public interface) and eth1 (internal interface LAN). I have created an alias eth1:1 in order to have two subnets on same physical interface:

auto eth0
iface eth0 inet static
address 111.111.11.x11
gateway set to the IP router

auto eth1
iface eth1 inet static

auto eth1:1
iface eth1 inet static

My intention is to translate the two internals LAN subnets with own public IP.
I added an alias eth0:1 with another public IP 111.111.11.x12

On iptables I have created the following rules:
-A POSTROUTING -o eth0 -s -j SNAT --to 111.111.11.x11
-A POSTROUTING -o eth0 -s -j SNAT --to 111.111.11.x12

-A FORWARD -p tcp -m multiport -i eth1 -o eth0 -j ACCEPT --dports 80,443,25,110,21,995,465
-A FORWARD -m state -i eth0 -o eth1 --state ESTABLISHED,RELATED -j ACCEPT

If I stop the proxy service with the rules declared above the two subnets are translated correctly. with the IP of eth0 and the other( with the ip of eth0:1

If I enable squid that is listening on port 8080 in transparent mode on the same machine with the following rules to iptables:
-A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 8080

-A INPUT -p tcp -i eth1 -j ACCEPT --dport 8080

-A FORWARD -p tcp -m multiport -i eth1 -o eth0 -j ACCEPT --dports 443,25,110,21,995,465 (I have removed 80 port)
-A FORWARD -m state -i eth0 -o eth1 --state ESTABLISHED,RELATED -j ACCEPT

-A OUTPUT -p tcp -j ACCEPT --sport 8080

Squid file (cat/etc/squid/squid.conf):
http_port 8080 transparent
visible_hostname proxy
cache_mem 256 MB
cache_swap_low 90
cache_swap_high 95
maximum_object_size 2024 KB
cache_effective_user proxy
cache_effective_group proxy

acl lan src (I set /16 to allow two subnets to pass from squid)
acl all src

http_access allow lan
http_access deny all

From log file I see that both subnets are redirected to the proxy but I have seen that now the two subnets are translated both with the IP of eth0

What should I do to resolve this problem?

Thank you and good summer to all
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. Cybersecurity

Openvpn nat and iptables

good day good people hi first to tell that firewall and vpn is working as expected, but I notice something strange. I have host system ip) firewall is blocking everything except port to vpn. I have vpn on virtualized system (CentOS both host and virtual). ... (0 Replies)
Discussion started by: end
0 Replies

2. IP Networking

NAT via iptables - Won't work!!

Hi guys I'm running on debian on a small embedded system. I have a ppp interface that is connected to the internet (and works). My unit also has wifi access point (which works and I can connect to it). I want to allow connections to the wifi to be able to use the internet from ppp0... (1 Reply)
Discussion started by: alirezan1
1 Replies

3. IP Networking

Debugging NAT / prerouting issues (iptables)

Hello, Recently I discovered an issue with packet routing in the latest Android releases (4.4+ KitKat & Lollipop). It seems that the problem Android specific, but essentially it comes from the Linux kernel. I already filed a bug report to Google. You can see the details by searching for... (0 Replies)
Discussion started by: Vladislav
0 Replies

4. IP Networking

Nat and packet limits with iptables

Hi all, I have a following situation: - I want certain source IPs to be natted to a different destination IP and Port. Following is how I am achieving it: /usr/local/sbin/iptables -t nat -A PREROUTING -p tcp -s --dport 1500 -j DNAT --to-destination ... (3 Replies)
Discussion started by: ahmerin
3 Replies

5. Cybersecurity

iptables in a NAT scenario

Hi, I am learning IPTables have this question. My server is behind a firewall that does a PAT & NAT to the LAN address. Internet IP: Port: 10022 Server LAN IP: port: 22 Allowed Internet IPs:, I want to allow a set of IPs are to be able to... (1 Reply)
Discussion started by: capri_guy84
1 Replies

6. Red Hat

NAT Loopback and iptables

Hello, please can you help and explain me. I have two servers. Both are RHEL6. I use the first one like router and the second one for apache. Router forwards 80 port on the second server and I can open that from the internet (mysite.com, for example). But I can not open mysite.com if i try to... (0 Replies)
Discussion started by: 6765656755
0 Replies

7. Debian

Iptables Nat forward port 29070

Hello, the Nat and the forward worked on my debian server up to the reboot of machines. The following rules*: /sbin/iptables -t nat -A PREROUTING -p tcp -i eth2 -d xxx.xxx.xxx.xxx --dport 29070 -j DNAT --to-destination /sbin/iptables -A FORWARD -p tcp -i eth2 -o eth0 -d... (0 Replies)
Discussion started by: titoms
0 Replies

8. IP Networking

How to configure Full Cone NAT using iptables ?

Hi Experts; I want to find the right iptables commands combination to address the following need: - NEs are NATed thru the linux box (using iptables) towards the WAN cloud, where the NTP servers are situated. - In order to achieve redundancy, the NTP Servers are in a load balancing cluster... (0 Replies)
Discussion started by: lvl1s7a
0 Replies

9. IP Networking

iptables forward public IP, no NAT, Debian i386

Hello all, got kinda problem. Have two machines in LAN, one of them connected to Internet directly, another one must be forwarded through the first one. Masquerading works perfectly, but is not what is needed here. Both machines have public IP addresses, when the second machine is forwarded its... (0 Replies)
Discussion started by: Action
0 Replies

10. UNIX for Advanced & Expert Users

Forwarding internal internet packets to internal webserver using iptables

Hi, I need to redirect internal internet requests to a auth client site siting on the gateway. Currently users that are authenticated to access the internet have there mac address listed in the FORWARD chain. All other users need to be redirected to a internal site for authentication. Can... (1 Reply)
Discussion started by: mshindo
1 Replies
Login or Register to Ask a Question