I have written port-forwarding iptables
rules that I plan to roll-out to several machines in an automated way using Ansible. However, the POSTROUTING
chain rule requires a modification of the source address to be that of the local machine so the machine receiving the forwarded packets knows where to respond. The rule looks like:
iptables -t nat -A POSTROUTING -d 192.168.11.2 -o eth1 -p tcp --dport 22 -j SNAT --to-source 192.168.11.1
That is, after using DNAT in PREROUTING
to change the destination address to 192.168.11.2 (and ACCEPT
ing it), I must then use SNAT
to change the source address in the network header before sending the packet into the network.
Can this rule be written in such a way to specify symbolically that --to-source
should be "the local machine's IP"? I accomplished this by compiling the necessary commands into a series of piped commands:
iptables -t nat -A POSTROUTING -d 192.168.11.2 -o eth1 -p tcp --dport 22 -j SNAT --to-source $(ifconfig eth1 | grep -i "inet " | awk '{print $2}')
However, my intent is to generate an iptables
configuration file and just roll that out to each machine if possible.