1

I have three separate ubuntu VPS servers (A, B, C) previously I only had one IP address associated with server A and used iptables to forward any incoming packets to IP 11.22.33.44 on port 443 to ip address 55.66.77.88 (server B) and using server A as a gateway for my TCP connection to bypass the blocking in the client's region

I did that by adding a rule to PREROUTIN using the command below:

$ iptables -t nat -A PREROUTING -p tcp --dport 443 -j DNAT --to-destination 55.66.77.88:443

as well as adding a rule to POSTROUTING :

$ iptables -t nat -A POSTROUTING -j MASQUERADE

I want to purchase another IP address (99.10.11.12) from my VPS provider on server A which would be connected to eth1 and forward packets on that address to server C (13.14.15.16) enter image description here

but as soon as the second IP is purchased and active, everything stops working even the packets incoming to 11.22.33.44 don't get to server B.

I'm not sure how to config the rules to get what I want and trying to learn about iptables only confused me even more.

1 Answer 1

0

Once a server has two or more network interfaces, asymmetric routing can be a problem. For example, a packet can come through eth0 on server A and get forwarded to server B. When the return packet comes back from server B to server A, it might attempt to escape through eth1 to the internet because that is where the default gateway is pointing to (or vise versa)

In this example server A will be configured with four interfaces:

eth0 - 1.0.0.1 (WAN-1 facing)
eth1 - 1.1.1.1 (WAN-2 facing)
eth2 - 10.2.2.1/24 (LAN-B facing)
eth3 - 10.3.3.1/24 (LAN-C facing)

Server B will have an IP of 10.2.2.2/24 with a default gateway pointing to server A's eth2 interface (10.2.2.1)

Server C will have an IP of 10.3.3.2/24 with a default gateway pointing to server A's eth3 interface (10.3.3.1)

Since server A has four IP addresses and there can only be one default gateway at a time else you might run into asymmetric routing issues.

On server A, you can execute the following commands to control the traffic

Traffic coming through eth2 (LAN-B facing) must be translated to eth0's public IP (1.0.0.1)

$ sudo iptables -t nat -A POSTROUTING -o eth2 -s 10.2.2.0/24 -j SNAT --to-source 1.0.0.1

Traffic coming through eth3 (LAN-C facing) must be translated to eth1's public IP (1.1.1.1) on its way to the internet

$ sudo iptables -t nat -A POSTROUTING -o eth3 -s 10.3.3.0/24 -j SNAT --to-source 1.1.1.1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .