My goal is to redirect connections from the local host to a remote server, and be able to change the remote address on the fly, without any client config changes. I can do this now using a nat on the external interface like so:
LOCAL_IP=10.1.1.10 LOCAL_PORT=8888 REMOTE_IP=10.1.1.11 REMOTE_PORT=9999 iptables -t nat -A OUTPUT -p tcp -d $LOCAL_IP --dport $LOCAL_PORT -j DNAT --to-destination $REMOTE_IP:$REMOTE_PORT iptables -t nat -A POSTROUTING -p tcp -d $REMOTE_IP --dport $REMOTE_PORT -j SNAT --to-source $LOCAL_IP
This works fine, but still couples the client's config to the hosts IP address. What would be really nice, is to be able to NAT traffic going to
10.1.1.11:9999. This seems like something that should be possible using a DNAT/SNAT|MASQUERADE combination, but I haven't come up with a working configuration yet. Any configurations I try seem to silently drop the packets (possibly caught by the martian rules? I do have ip_forward enabled).