1

I have a linux server behind the ISP's cablemodem-router combo. With some hacking I was able to make the port forwarding work, and the DHCP exceptions in the udhcpd. But I wasn't able to do the NAT loopback: I can reach the server outside of my local network, but at home I can't. The router uses arno's iptables firewall, but the old version of it, so it hasn't got the nat loopback plugin. I want to make it work with the plain iptables.

Here is my current rule set: http://pastebin.com/SFNeY0Cu

I've found these commands:

iptables -t nat -A POSTROUTING -d 192.168.0.150 -s 192.168.0.0/24 -j SNAT --to-source 192.168.0.1
iptables -t nat -A PREROUTING -d $WANIP -m tcp -p tcp -j DNAT --to-destination $SERVERIP

Could someone explain me these commands? I think I understand the second, but the the first isn't clear to me. What is that 192.168.0.150? Or the 192.168.0.1? My home server is on the $SERVERIP, and my outer address is the $WANIP

Thanks for any help.

  • Could you please elaborate the final goal. What exactly you would like to achieve? – Serge May 23 '16 at 17:39
  • 1
    I would want to reach the home server on the external ip, just like from outside. Basically: nat loopback/nat reflection/nat hairpinning with iptables. – user3853774 May 23 '16 at 19:45
  • Ah, OK. I just never seen the term NAT loopback before, however, I have been playing with configuration you describe. Eventually, I dropped such kind of configs from my consideration: it makes impossible to identify the host that connected to the server from internal LAN (at the server, without connecting to the router and inspecting active conntrack'ed connections) and I don't like this. – Serge May 23 '16 at 21:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.