I have a challenging situation where I have 5 devices which act as wireless access points. I need to be able to access TCP 8080 on each device from a central device. All wireless devices have a address and dish out a DHCP address over wireless. I have a Pi connected via 5 wireless cards (on a powered hub) as so....

enter image description here

Ideally I want to connect to eth0 on the Pi nic on ports 8081,8082 etc and be NAT'd to each of the different devices on port 8080. I looked into namespaces but my wireless cards don't support it so I need to find a solution with ip route / iptables. Been thrashing around for a few days and haven't found a good example to work from. Some help would be appreciated.



I'm not an iptables expert by any means but this is what finally worked with help from this article suggested above from Arushix.


#flush routes
ip route flush
ip route flush
ip route flush default via

#flush iptables
iptables -P INPUT ACCEPT
iptables -t nat -F
iptables -t mangle -F
iptables -F
iptables -X

#NAT'd packet responses sent back to the eth0 ip
iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source
iptables -t nat -A POSTROUTING -j MASQUERADE

#Add a separate routing table and firewall mark for each incoming port  
ip rule add fwmark 4 table 4

#mark the packets
iptables -t mangle -A PREROUTING -p tcp --dport 8084 -j MARK --set-mark 4

#route through the appropriate interface    
ip route add dev wlan4 table 4

#packets to 8084 nat'd to device 8080
iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 8084 -j DNAT --to-destination

#turn off spoofing protection
sysctl -w net.ipv4.conf.eth0.rp_filter=0

#do it for all the interfaces 
ip rule add fwmark 3 table 3
iptables -t mangle -A PREROUTING -p tcp --dport 8083 -j MARK --set-mark 3
ip route add dev wlan3 table 3
iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 8083 -j DNAT --to-destination  

ip rule add fwmark 2 table 2
iptables -t mangle -A PREROUTING -p tcp --dport 8082 -j MARK --set-mark 2
ip route add dev wlan2 table 2
iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 8082 -j DNAT --to-destination

ip rule add fwmark 1 table 1
iptables -t mangle -A PREROUTING -p tcp --dport 8081 -j MARK --set-mark 1
ip route add dev wlan1 table 1
iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 8081 -j DNAT --to-destination

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.