I have a physical network with a Linux server (Ubuntu 16.04, kernel 4.13) and several gadgets on it. Each gadget has the same unchangeable static IP, e.g. 192.168.0.222/24. I would like to communicate with all these gadgets via an arbitrary IP protocol (e.g. ICMP ping or a custom UDP protocol)
Fortunately I have a managed network switch connecting the server and the gadgets. I've configured the switch to have a trunk port for the server and access ports for each gadget, each on a different VLAN (VIDs 11, 12, etc).
I have added
8021q to /etc/modules and set up VLAN entries in /etc/network/interfaces:
auto eno2 # For switch management interface iface eno2 inet static address 192.168.2.2/24 auto eno2.11 # Gadget 1 (only) iface eno2 inet static address 192.168.0.1/24 #auto eno2.12 # Gadget 2 - disabled #iface eno2 inet static # address 192.168.0.1/24
With the entries as shown above, I can communicate with gadget 1 (e.g.
ping 192.168.0.222) and don't see any traffic from gadget 2.
But I'd like to be able to communicate with all gadgets at the same time, and be able to distinguish one from the other. They don't need to talk to each other. I was thinking for each gadget I could create a unique host IP and subnet, e.g.
Host IP & subnet "Fake" gadget IP Actual gadget IP VLAN Interface 192.168.101.1/24 192.168.101.222 192.168.0.222 eno2.11 192.168.102.1/24 192.168.102.222 192.168.0.222 eno2.12
nftables to handle the translation in each direction. Then I could
ping 192.168.101.222 to reach gadget 1, and
ping 192.168.102.222 to reach gadget 2. From each gadget's point of view, its own IP would still be 192.168.0.222 and it would see the ICMP echo requests coming from 192.168.0.1.
This seems like a somewhat unusual variant on NAT. Note the traffic with the "fake" IPs doesn't need to (and shouldn't) leave the server - we're not forwarding to something else on the network.
- Is this a reasonable approach to the problem?
- How do I set up /etc/network/interfaces and iptables or nftables to achieve this?