My task is to redirect traffic (port range) through the server. Here is the schema:

enter image description here

Why NAT is not appropriate here: If NAT is set to "Tunnel Server", then all users will be assigned the same IP.

What I need: I want that when user connects to "Tunnel server" he was automatically redirected to "Server" and IP of this user was not changed. The endpoint must see the real IP of the user.

enter image description here

Now I have this NAT rules:

$IPT -t nat -A PREROUTING -d $SRV_IP -p tcp --dport 25550:25580 -j DNAT --to-destination $MC_IP
$IPT -t nat -A POSTROUTING -p tcp --dport 25550:25580 -o eth0 -d $MC_IP -j SNAT --to-source $SRV_IP
$IPT -A FORWARD -d $MC_IP -p tcp --dport 25550:25580 -j ACCEPT

And the endpoint server show the IP of "Tunnel server" on every client.


You've got 10.* addresses internally so you must use NAT if you want them reachable from the Internet in general.

Create a DNAT (Destination NAT, or Port Forwarding) rule on the Tunnel Server that directs users to the corresponding port on your Server.

UPDATE in response to the amendment in the Question that shows the output from iptables.

You say that you need the SNAT rule in order to have the users connect to the Server You can remove that rule provided you add a default route on the Server that has your Tunnel Server as the gateway. This will define the return path for packets originating on the Internet.

route add -net default gw
  • Server also have public IP. NAT modify client IP, but I need to get it real IP. – user2058653 Mar 11 '15 at 7:11
  • user2058653 You would have real client IPs. Why wouldn't you? – roaima Mar 11 '15 at 8:08
  • Look at my NAT rules, I have edited my post. My server say that every user have the same IP as "Tunnel server". – user2058653 Mar 11 '15 at 9:52
  • 1
    Remove the SNAT rule, the DNAT is enough as long as the default route on the destination system is back via the same route. – wurtel Mar 11 '15 at 11:02
  • Without SNAT it don't work. – user2058653 Mar 11 '15 at 19:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.