0

I would like to be able to change the source address of all traffic that is going outbound from my linux server on ports 53 (DNS), 67 & 68 (DHCP)

I tried with iptables/firewalld:

firewall-cmd --permanent --direct --add-rule ipv4 NAT POSTROUTING 0 -o ens256 -j SNAT --dport 67 --to 10.10.10.10 

and

iptables -A POSTROUTING -t nat -o ens256 -p tcp -j SNAT --to 10.10.10.10:67

I'm open to doing whatever it takes to make this happen but also curious if it possible to do without the use of iptables/firewalld, perhaps with static IP routes?

2
  • as ErikF told, the simpliest is to use a 2nd IP and change the applications' configuration. Doing it with iptables + MARK + ip rule fwmark doesn't work easily nor always well especially for UDP (and it might be worse for DHCP on linux if raw sockets are in use).
    – A.B
    Commented Jun 7, 2018 at 21:45
  • the applications (in this case, DNSMASQ) are already configured to receive on the specified ports, and this part is working properly. looking to send back to destination with a different source IP / interface than it was received but only for these ports. any other traffic needs to be returned on the same interface.
    – Devin
    Commented Jun 8, 2018 at 15:56

1 Answer 1

1

I would recommend using a secondary IP address on your interface and binding your server processes to that address instead, like this:

# ip addr add 10.10.10.10/xx dev ens256

That way, the system knows what you're actually trying to do (netstat will show correct information, for example), and your firewall is much less complex.

1
  • In my scenario, I'm actually trying to "bind" these ports to an IP address that's on a different interface. So lets say, traffic on port 67 comes in on interface en256 (with IP 192.168.69.10) but I want it to go out on a loopback address of 10.10.10.10. It's a loopback because I'm using BGP peering. I thought just changing the source address on the way out might work using SNAT, but if there is a way to bind it.. that's something I hadn't thought of.
    – Devin
    Commented Jun 8, 2018 at 15:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .