My linux board has 2 interfaces one physical eth1 and another tap interface tun0. i need to forward all the packets with source IP as tun0 IP to eth1 IP. So i was thinking of using natting. I used the where 2001:db8:0:f101::1/64 is tun0 ip and fd01:cab:1:16::190/64 is the eth1 IP.

ip6tables -t nat -A INPUT/POSTROUTING --source 2001:db8:0:f101::1 -j SNAT --to-source fd01:cab:1:16::190

root@xxxxxxxxx:/mnt/mainfs/local# ifconfig eth1
eth1      Link encap:Ethernet  HWaddr 08:6A:0A:5B:17:07
          inet addr:  Bcast:  Mask:
          inet6 addr: fe80::a6a:aff:fe5b:1707/64 Scope:Link
          inet6 addr: fd01:cab:1:16::190/64 Scope:Global
          RX packets:1685 errors:0 dropped:3 overruns:0 frame:0
          TX packets:2433 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:213026 (208.0 KiB)  TX bytes:409380 (399.7 KiB)

root@xxxxxxxxx:/mnt/mainfs/local# ifconfig tun0
tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet6 addr: 2001:db8:0:f101::1/64 Scope:Global
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:500
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

I am trying to ping one machine fc01:eab:96:1::4 from my board, but ping is not happening. Is my SNAT command proper??

root@msmci-ASK170100080:/mnt/mainfs/local# ping6 fc01:eab:96:1::4 -I 2001:db8:0:f101::1
PING fc01:eab:96:1::4 (fc01:eab:96:1::4) from 2001:db8:0:f101::1: 56 data bytes

root@msmci-ASK170100080:/mnt/mainfs/local# ping6 fc01:eab:96:1::4
PING fc01:eab:96:1::4 (fc01:eab:96:1::4): 56 data bytes
64 bytes from fc01:eab:96:1::4: seq=0 ttl=61 time=1.840 ms
64 bytes from fc01:eab:96:1::4: seq=1 ttl=61 time=1.544 ms
--- fc01:eab:96:1::4 ping statistics ---
2 packets transmitted, 2 packets received, 0% packet loss
  • You have enabled forwarding? The FORWARD chain accepts as default policy, or you have proper rules? I also recommend MASQUERADE (automatic choice of new source address) instead of SNAT. – dirkt Mar 6 at 11:18
  • For now i have ACCEPT all packets by below command : ip6tables -I INPUT -j ACCEPT; ip6tables -I OUTPUT -j ACCEPT; ip6tables -I FORWARD -j ACCEPT – user2471163 Mar 6 at 13:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.