3

I have a router in which I installed a Linux system.

I want my router supports NAT hairpinning

Does a such feature exists in Kernel Linux? If yes how to activate it? Are there a patch to apply it on my kernel to support hairpinning?

Hairpinning explanation from Wikipedia:

Let us consider a private network with the following:

    Gateway address: 192.168.0.1
    Host 1: 192.168.0.5
    Host 2: 192.168.0.7

    The gateway has an external IP : 192.0.2.1
    Host 1 runs a P2P application P1 on its port 12345 which is externally mapped to 4444.
    Host 2 runs a P2P application P2 on its port 12345 which is externally mapped to 5555.

If the NAT device supports hairpinning, then P1 application can connect to the P2 application using the external endpoint 192.0.2.1:5555.
If not, the communication will not work.
3

This is something that iptables handles just fine with a "recent" kernel (anything since 2.4, that's older than 10 years).

The trick is to do a "reverse natting": map the IP address of any host from your local net that is accessing the two NATted servers to the public IP of your gateway.

Something like the following (that's only that NATting rules, no firewalling):

iptables -t nat -A PREROUTING -p tcp -m tcp  -s 192.168.0.0/24   -d 192.168.0.5  --dport 4444 -j DNAT --to-destination :12345
iptables -t nat -A POSTROUTING -o eth1  -p tcp -m tcp  -s 192.168.0.0/24   --dport 12345 -j SNAT --to-source 192.10.2.1
iptables -t nat -A PREROUTING -p tcp -m tcp  -s 192.168.0.0/24   -d 192.168.0.7  --dport 5555 -j DNAT --to-destination :12345
iptables -t nat -A POSTROUTING -o eth1  -p tcp -m tcp  -s 192.168.0.0/24   --dport 12345 -j SNAT --to-source 192.10.2.1
iptables -t nat -A PREROUTING -p tcp -m tcp   -d 192.168.0.1  --dport 4444 -j DNAT --to-destination 192.168.0.5:12345
iptables -t nat -A PREROUTING -p tcp -m tcp   -d 192.168.0.1  --dport 5555 -j DNAT --to-destination 192.168.0.7:12345
iptables -t nat -A POSTROUTING -o eth0   -j SNAT --to-source 192.168.0.1

If you are not familiar with the arcane art of writing firewall rules, I suggest using a GUI-frontend like fwbuilder.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.