1

I am having difficulties configuring NAT with iptables on my firewall.

My firewall setup is as follow:

  • it is a layer 2 transparent firewall, between my gateway and my ISP's gateway
  • I bridged two interfaces as br0. The two interfaces are eno0 on my ISP side and eno1 on my local network side
  • I set up basically no iptables rules except one for NAT

Here are my rules:

root@firewall:~# iptables -S
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
root@firewall:~# iptables -t nat -S
-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT
-A POSTROUTING -s 10.50.1.0/24 -j SNAT --to-source xxx.195.142.205
root@firewall:~# iptables -t mangle -S
-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT

The problem is, in short, that address translation works for outgoing traffic but not for the replies. Here is a test example:

  • I connected a laptop with IP 10.50.1.7 on my LAN and used it to ping 8.8.8.8
  • on the firewall, with tcpdump -i eno1, I see ICMP requests from 10.50.1.7 to 8.8.8.8, but no replies
  • on the firewall, with tcpdump -i eno0, I see ICMP requests from xxx.195.142.205 to 8.8.8.8, and the ICMP replies from 8.8.8.8 to xxx.195.142.205
  • Obviously, on the laptop, I do not get the ICMP replies

So the replies are not translated back to the local IP. What am I missing ?

Thanks for your help!

(NB: when removing the NAT rule and using the public IP xxx.195.142.205 on the laptop, I have full internet access)

Improve this question
4
  • You'd want MASQUERADE rather than SNAT.
    – Ralph Rönnquist
    Sep 9, 2017 at 5:49
  • Why would it work any better with MASQUERADE ? Using it isn't an option anyway, for two reasons : there will be multiple NAT rules, that is to say different public IPs for different local IP pools (I only included one for the sake of the example), and the firewall has no IP as it is a layer 2 firewall so MASQUERADE won't know which public IP to use as a replacement.
    – oxley
    Sep 9, 2017 at 7:39
  • I'm a bit confused about the setup. If eno0 and eno1 are the only interfaces and they are bridged, then iptables will have no effect. If you want to do NAT/MASQ between eno0 and eno1, you need to route, not bridge. I'm pretty baffled this worked for outgoing traffic at all (but possibly POSTROUTING applies, while conntrack fails on the bridge). Could you edit the question and explain why you need a layer 2 transparent firewall?
    – dirkt
    Sep 9, 2017 at 8:53
  • Thank you for your answer! I have no particular reason to use a layer 2 transparent firewall, except that it is what my predecessors used and recommended. However, they only used firewall iptables rules that did not need conntrack, so your theory that conntrack fails on the bridge may be right. After your answer, I tried setting up a layer 3 firewall instead, but I am experiencing other difficulties. If you have a minute to help me out, here is the other issue: serverfault.com/questions/872818/… . Thanks!
    – oxley
    Sep 9, 2017 at 12:31

1 Answer 1

Reset to default
1

As suggested by @dirkt, it looks like conntrack does not work well with a bridge. So iptables rules that don't require seem to work on a bridge, but not NAT.

Problem solved as soon as I configured my firewall as a layer 3 firewall.

In case others are interested: I extensively searched the Web if it was possible to use a transparent layer 2 firewall with NAT, but never got a straight answer.

ebtables website do suggest that it is possible:

bridge-nf code makes iptables see the bridged IP packets and enables transparent IP NAT.

I never found out which ebtables command would make it work though.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .