I've a Linux box with 3 network adapaters, which I'd like to configure as follow:

  1. Adapter A is connected to computer A
  2. Adapter B is connected to computer B
  3. Adapter C is connected to the Internet. Specifically, to someserver.com

What I want to acheive:

  1. All traffic from A will go to the Internet
  2. Define a special "secret port" on Adapter B
  3. TCP traffic coming from Computer B going to 'someserver.com' on 'secret port' will masquerade its source IP to appear as it is coming from Computer A
  4. TCP traffic coming back from 'someserver.com' going to Computer A to the same port used in #3, will redirect to computer B.

Do I need to implement a router or a bridge? Can I do it merely by configuring NetFitler/ip tables or should it implement some code? If code, at which layer to I integrate with the IP stack?

  • 1
    One thing I do not understand: someserver.com will not see whether the request originated at A or B. (Since all the traffic toward the Internet will have to be masqueraded when leaving C). Am I missing something? – Marki Nov 16 '14 at 14:54
  • 1
    @Marki, there is no masquerading. A and B have Internet public addresses. The Linux box is either a bridge or a router, but there is no address translation. – Uri Nov 16 '14 at 20:02
  • I'd just be too curious about a use case for this. – Marki Nov 16 '14 at 20:06
  • @Marki - computers A and B are on the internet. When they go to someserver.com, they always do so from my Linux box (e.g. specific routing). A and B cooperate. On occasion, we want computer B to go to someserver.com without someserver being aware requests are coming from a different machine. – Uri Nov 16 '14 at 20:16
  • Ok but that's still not a "use case". Somehow, I don't feel comfortable helping B make it look as though A was the source. – Marki Nov 16 '14 at 20:26

For general access, you'll have to use MASQUARADE / SNAT (depending if your IP address on C is dynamic or static).

So let's say current situation is your computer A has static IP address a.a.a.a, and your computer B has static IP address b.b.b.b. Both have default gateway to computer C. And Someserver.com has static IP address r.r.r.r and secret port is pppp.

You would configure computer C as router, which would have its default route to the Internet interface C (it already does that, either via static configuration, or being dynamically setup via PPPoE, etc). That by itself will accomplish 1.

Now, you have two possibilities:

  1. make computer A router too. Then you change computer B config so its default route is via computer A (and not computer C as before), and configure computer A like this:

    iptables -t nat -s b.b.b.b -d r.r.r.r -p tcp --dport pppp -j SNAT --to a.a.a.a

    that would make all TCP packets from source IP b.b.b.b going to destination IP r.r.r.r and destination port pppp pretend like they're coming from a.a.a.a, thus accomplishing 3, and traffic from someserver.com will go back to what was source address (a.a.a.a), which would be decoded by computer A and sent back to computer B. (thus accomplishing 4)

    That is easier, but requires that you computer B is running OS that is capable of such NAT policies.

  2. change computer A to have private IP like and computer B to have private IP Then on computer C do:

    ip addr add a.a.a.a/nn dev ifaceC
    ip addr add b.b.b.b/nn dev ifaceC
    iptables -t nat -s -j SNAT --to a.a.a.a
    iptables -t nat -s -d r.r.r.r -p tcp --dport pppp -j SNAT --to a.a.a.a
    iptables -t nat -s -j SNAT --to b.b.b.b

    where nn is your netmask and ifaceC is name of your interface C. That would put computer A and computer B in private ranges, thus allowing computer C to NAT computer A to a.a.a.a (so it behaves like before), and NAT computer B either to a.a.a.a (if dst=r.r.r.r, dport=pppp condition is met) or to b.b.b.b (otherwise).

This does not require any special support on computer A nor computer B, but puts them behind NAT which might affect some other things.

And of course, it this age it should be mentioned that above will only work for good ol' IPv4 addresses (the last of which are rapidly being used up) and not on IPv6

| improve this answer | |
  • Thank you. #1 will not work for my configuration. For option 2: If computers A and B both have public address. Can I have a.a.a.a and b.b.b.b be and (their own IP) respectively? Also, can you recommend a good resource for setting up a router? – Uri Nov 17 '14 at 15:35
  • No, you must remove public addresses from them, and setup private addresses instead (like recommended 10.0.1.*). That is because with ip addr add you will move public addresses from A and B to C, so it can do NAT for them, and they must not be present elsewhere! For setting up a router, you should first have excellent knowledge of how TCP/IP works in general, and then apply it to specific router. For later step for generic GNU/Linux machines, LARTC is good intro. – Matija Nalis Nov 17 '14 at 23:12

Per your comment:

@Marki - computers A and B are on the internet. When they go to someserver.com, they always do so from my Linux box (e.g. specific routing). A and B cooperate. On occasion, we want computer B to go to someserver.com without someserver being aware requests are coming from a different machine.

Am I missing something here? If you set Computer C up as a Router, the requests from A and B won't matter. The Private/Public IP Addresses from both A and B will both be exchanged with the Public IP Address from Computer C, according to the rules of NAT. Therefore if C is the last Gateway in the chain for your network, someserver will see all requests coming from C, and C will route them back to A and B.

In order for this to work, Computer C, needs two network cards, one connected to the private LAN, and the other connected to the Public WAN.

Below is Matija's Number 2
If you want Computer B to mimic Computer A, B must filter it's traffic through A before reaching C. I don't see how this help's your "use case" as computer C only sees traffic from computer A, but regardless:

Someserver will never see a private address from A or B. You're overkilling the situation here, as all you need to do is enable port forwarding on computer C so that all ports get forward to the private IP address for Computer B.

| improve this answer | |
  • 1
    I apologize I wasn't clear about it. There are no private addresses. A and B have public Internet addresses. They route through C, but there is no NAT involved. I do want to change the source address when B is going to the Interneton specific scenarios (e.g. specific port on someserver) to A. In normal scenarios, someserver gets the public source address of A. – Uri Nov 17 '14 at 22:49
  • Whether A and B Are public or not, setup a DHCP Server on C that gives A and B public Addresses, then setup port Forwarding to the Public IP Address on B for the specific ports you want to watch. When Routing to the Internet someserver will only see the requests coming from C, but B will be reachable because it's Public. – eyoung100 Nov 17 '14 at 22:56

You solve this problem by installing a proxy on A which will listen for B/SecretPort and forward it to SomeServer. Answers picked on A with SecretPort are forwarded to B.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.