I am having difficulties configuring NAT with iptables on my firewall.
My firewall setup is as follow:
- it is a layer 2 transparent firewall, between my gateway and my ISP's gateway
- I bridged two interfaces as br0. The two interfaces are eno0 on my ISP side and eno1 on my local network side
- I set up basically no iptables rules except one for NAT
Here are my rules:
root@firewall:~# iptables -S
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
root@firewall:~# iptables -t nat -S
-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT
-A POSTROUTING -s 10.50.1.0/24 -j SNAT --to-source xxx.195.142.205
root@firewall:~# iptables -t mangle -S
-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT
The problem is, in short, that address translation works for outgoing traffic but not for the replies. Here is a test example:
- I connected a laptop with IP 10.50.1.7 on my LAN and used it to ping 8.8.8.8
- on the firewall, with
tcpdump -i eno1
, I see ICMP requests from 10.50.1.7 to 8.8.8.8, but no replies - on the firewall, with
tcpdump -i eno0
, I see ICMP requests from xxx.195.142.205 to 8.8.8.8, and the ICMP replies from 8.8.8.8 to xxx.195.142.205 - Obviously, on the laptop, I do not get the ICMP replies
So the replies are not translated back to the local IP. What am I missing ?
Thanks for your help!
(NB: when removing the NAT rule and using the public IP xxx.195.142.205 on the laptop, I have full internet access)
MASQUERADE
rather thanSNAT
.eno0
andeno1
are the only interfaces and they are bridged, theniptables
will have no effect. If you want to do NAT/MASQ betweeneno0
andeno1
, you need to route, not bridge. I'm pretty baffled this worked for outgoing traffic at all (but possibly POSTROUTING applies, while conntrack fails on the bridge). Could you edit the question and explain why you need a layer 2 transparent firewall?