SNAT to unroutable interface

Question

I set up a virtual ethernet (veth) pair between default namespace and another namespace named RoutableNS as follow:

--------------              --------------
-   veth0    - --------------    veth1   -
-  10.5.1.1  -              -  10.5.1.2  -
--------------              --------------
  default NS                 RoutableNS

I can ping outside world in namespace RoutableNS through interface veth1 but It turns out when I SNAT (or MASQUERADE) incoming traffic to 10.5.1.1 (or 10.5.1.2) nothing will come to veth interface.

I tried same thing with tun devices and I saw It's not possible to MASQUERADE to tun device when It's IP is not routable to outside world (in default namespace).

So I have two questions:

1. Is this behaviour of SNAT (MASQUERADE) documented somewhere? I mean the behaviour that new source IPs should be routable to outside world in current namespace.
2. Is there a networking options (sysctls) letting me do this?

Answer 1

It's perfectly possible to masquerade or SNAT a device whose IP is not routable to the outside world. And being in a network namespace or not makes no difference.

You conveniently forgot to tell us what exactly you tried, but keep in mind that SNAT and MASQUERADE only work in the POSTROUTING table (while DNAT only works in the PREROUTING table), a fact which is well documented, and which you can't avoid to mention explicitely in the iptable commands.

That means SNAT will happen as the last step before the packet leaves the interface, and DNAT will happen as a very early steps for packets entering the interface from the outside.

So the usual setup is that a router (host or namespace) NATs IPs that come in from one side, to everything on the other side:

                +---------------+
                |               |
masq'ed IP --<--| eth0     eth1 |--<-- original IP
10.0.0.99       |               |      10.0.0.1
                +---------------+
                Host or Namespace

and you need a corresponding DNAT for incoming connections, so:

iptables -t nat -A POSTROUTING -o eth0 -s 10.0.0.1/32  -j SNAT --to 10.0.0.99
iptables -t nat -A PREROUTING  -i eth0 -d 10.0.0.99/32 -j DNAT --to 10.0.0.1

You didn't say exactly what IPs you want to masquerade as what IPs, but if your main namespace acts as such a router, and you want to mask "RouteableNS", that is 10.5.1.2, to the outside world, then this is doable by using the outgoing IF of your main namespace.