I have this situation: a piece of software got hardcoded IP address (let assume it is being to which it binds a socket and sends TCP and UDP traffic to (hardcoded too). Problem is that for system to work there should be several instances of this software on separate different hosts. There is no chance to modify the software.

original setup was involving some kind of non-RFC compatible network hardware that was mapping MACs in first LAN into MACs in second LAN. Now it is required to emulate it without any extra network hardware - just a hot per instance of client and a host for server. There is (new) server software that expect to accept packets and respond, using separate NIC for each instance, IP addresses allowed to be in arbitrary subnets.

I do not see any problem with the server part, but there is now way that hosts with same IPs can be connected to server. I assume there is no problem with using system software to resolve it, but I don't know how to emulate an interface with required IP on client host and redirect traffic to server, to send traffic from server to client software (which would expect it coming from non-existing I was told that it is possible with iptables, but all I know about that iptables is packet filter\NAT software. I may doubt that suggestion, because one who told me so knows even less than me. I have partial solution, without DMZ and redirection of traffic to proper ip

ip netns add vn
ip link add v-eth0 type veth peer name v-local
ip link set v-local netns vn

ip addr add dev v-eth0
ip netns exec vn ip addr add dev v-local
ip link set v-eth0 up
ip netns exec vn ip link set v-local up

ip netns exec vn ip route add default via
echo 1 > /sys/net/ipv4/ip_forward
iptables -P FORWARD DROP
iptables -F FORWARD
iptables -t nat -F
iptables -t nat -A POSTROUTING -s -o eth0 -j MASQUERADE
iptables -A FORWARD -i eth0 -o v-eth0 -j ACCEPT
iptables -A FORWARD -o eth0 -i v-eth0 -j ACCEPT

This setup allows process in namespace container to access real network, but doesn't allow redirectio I require. Let assume that eth0 got IP and server got IP How I should modify the script above to be able

1) to redirect packets from destinated to, so they would be sent to, and

2) to redirect packets, received by, to be sent to

  • Have you confirmed this IP can not be hex-edited? – Tigger May 12 '17 at 8:57
  • @Tigger 3 problems with that: 1) checksum wouldn't match, software checks it's consistency 2) this would an official document that would describe practice of..what, IP breach? 3) hex edit would require create copy of software for each client host, their number and network configuration is changeable – Swift May 12 '17 at 9:08
  • @dr01 I can't name software or producer, but producer is formerly department of same co, suspected of inside trade in cooperation with subcontractor that developed MAC substitution device – Swift May 12 '17 at 9:11
  • 1
    Look at the snat and dnat targets for iptables (see man iptables-extensions). You may need an additional instance or network namespace with veth pairs to do the actual masquerading. I haven't done this myself yet, so I can't give step-by-step instructions. – dirkt May 12 '17 at 11:34
  • @dirkt iptables-extensions do not exist on this platform. Is it screwed then? (and no, not in repository, they don't exist at all), Namepaces are supported, and that far I know that it requres to create namespace and virtual interfaces – Swift May 14 '17 at 9:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.