virtual gateway via NAT

Question

I have following networking setup:

Gateway:

Internet <-- eth0 : a.b.c.d (static address)
Clients <-- eth1  : DHCP at server at 172.16.0.1, leasing 172.16.0.0/24

Client:

Gateway <-- eth0: 172.16.0.0/24

Clients can reach internet and forwarding is working. I want to create some kind of "virtual" address, which clients can access via gateway, but that address would be in fact some machine on the Internet.

So, when they connect to 172.32.1.1 they in fact connect to google and so on. I tried it with NAT:

TARGET=$(dig -q google.com)
VIRTUAL=172.32.1.1
iptables -t nat -A PREROUTING -d "$VIRTUAL" -j DNAT --to "$TARGET"
iptables -t nat -A POSTROUTING -s "$TARGET" -j SNAT --to "$VIRTUAL"

that somehow works, however when I ping it from gateway I get

From 20.249.x.y icmp_seq=1 Destination Net Unreachable

(where 20.249.x.y is my Gateway's gateway), and when I traceroute to that virtual IP from the client, I get this:

traceroute to 172.32.1.1 (172.32.1.1), 30 hops max, 38 byte packets
 1  172.32.1.1 (172.32.1.1)  31.886 ms  31.638 ms  34.029 ms
 2  172.32.1.1 (172.32.1.1)  39.660 ms  40.489 ms  39.153 ms
 3  172.32.1.1 (172.32.1.1)  41.879 ms  40.367 ms  40.436 ms
 4  172.32.1.1 (172.32.1.1)  47.375 ms  48.200 ms  48.878 ms
 5  172.32.1.1 (172.32.1.1)  47.801 ms  47.280 ms  47.405 ms

That looks super weird to me. Is there a way to fix these issues? I was trying to use ip tunnel, but it looks like it needs different end setting up as well, which I obviously cannot do.

iptables config on server contains these two rules and -A FORWARD -i eth1 -j ACCEPT only.

Answer 1

You might want to flush existing broken iptables rules, and start from scratch. On the Linux box acting as gateway, assume the following conditions:

The linux gateway has two NICs; eth0 is LAN facing while eth1 is WAN facing.

Enable IP packet forwarding on the gateway:

$ sudo echo 1 > /proc/sys/net/ipv4/ip_forward

Create two test virtual IPs (VIP) on eth0 as per our test plan

$ sudo ifconfig eth0:1 10.1.1.1 netmask 255.255.255.0
$ sudo ifconfig eth0:2 10.8.8.8 netmask 255.255.255.0

Configure iptables as per our plan

sudo iptables -t nat -A PREROUTING -d 10.1.1.1 -j DNAT --to 1.1.1.1
sudo iptables -t nat -A PREROUTING -d 10.8.8.8 -j DNAT --to 8.8.8.8
sudo iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

In this case, when a user ping the VIP 10.1.1.1, there will be redirected to Cloudflare's 1.1.1.1

If a user ping the VIP 10.8.8.8 they will be redirected to Google's 8.8.8.8

10.1.1.1 ---> 1.1.1.1
10.8.8.8 ---> 8.8.8.8

Answer 2

I tried it with NAT [...] that somehow works, however when I ping it from gateway I get [network unreachable]

As the name implies, the PREROUTING and POSTROUTING chains are only used for packets that come in to the gatway and are routed to go outside.

That means in particular that they don't apply to any packets the originate on the gatway, like the ping you are doing. There is no way to fix that, the filter chains are just weird this way. But for your usecase, you only want the NAT from the clients, so it doesn't matter.

(And BTW, you only need DNAT; this will create a CONNTRACK entry, and the reverse NAT will be done automatically).