I have several switches with the same factory-set static address, each connected to a server with two interfaces, one server to each switch. The server's primary interface is to the local house network and it's secondary interface is to a subnet which includes the switch's address. I would like to be able to assign a name to each switch, have the name resolve to a house network address on the associated server, and configure each server to transparently forward traffic sent to that address to the switch and traffic from the switch back to the origin house network address. It seems likely that iptables NAT should be able to do that. So I have the following rules in iptables.

-A POSTROUTING -p all -s switch -j SNAT --to house
-A PREROUTING  -p all -d house  -j DNAT --to switch

where "switch" is the switch's static address and "house" is the house net address I've assigned to the switch. (Both are entered numerically.) Of course, since I'm writing here, this doesn't work.

Before enabling iptables, I can ping the "house" address from the server and from other devices on the house network and I can ping the "switch" address from the server. Running nmap against the switch's static address from the server, I see the proper switch ports open, running nmap against the "switch" address from another device on the house network, I see the ports which are open on the server. After enabling iptables, ping still responds though I'm not sure which device is responding. nmap to the "switch" address from the server still shows the server's ports, not the switch's. nmap from another device reports that all ports are filtered.

I'm not changing the switch's static address for reliability. I want things to continue working if the switch is reset for any reason.

All I really need to work is ping and ports 80 and 443. There must be a better solution.

  • Shouldn't the first rule be a SNAT in POSTROUTING rather? – Ralph Rönnquist Mar 27 '19 at 8:18
  • Yes, thanks for pointing out that mistake. But after fixing it, things still don't work. (1) server can ping switch by its house address, others cannot. (2) server nmap to switch's house address reports server's ports, from others nmap reports all ports filtered. – Dave Close Mar 27 '19 at 17:17
  • and all primary interfaces are assigned the 'house' addresses as well as their 'server' IP addresses? – Ralph Rönnquist Mar 27 '19 at 20:33
  • Yes. eth1 has the server's normal house net address, eth1:sw has the "switch" house net address. Both are on the same subnet with the same netmask. – Dave Close Mar 27 '19 at 20:50
  • did you use -p all for the rules? try without that. I mean, those rule should work, but that -p all looks fishy to me :) – Ralph Rönnquist Mar 27 '19 at 22:42

It ended up as a longish comment chain :)

My last suggestion would thus be to add a rule:

iptables -t nat -A POSTROUTING -o $IFSW -j MASQUERADE

where $IFSW is the switch interface, to each server.

With that, the switches will receive the packets as sourced from their servers, and thus respond appropriately, and the servers would handle the mappings back to original addresses for the response packets.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.