0

I have two iptables rules like this:

# vmbr0 - WAN bridge, vmbr1 - LAN bridge
iptables -t nat -A PREROUTING -i vmbr0 -p tcp --dport 3306 -j DNAT --to-destination 10.5.0.250
iptables -t nat -A POSTROUTING -o vmbr1 -p tcp --dport 3306 -d 10.5.0.250 -j SNAT --to-source 10.5.0.1

Is that true, that when a computer in the same network, 10.5.0.10 for example, connects to another, 10.5.0.11 for example - address is being translated to 10.5.0.1 because of these rules?

How can I avoid that and leave local traffic unchanged?


I'm using virtualization (Proxmox). The virtualization host has a physical network eth0 connected with bridge vmbr0. Virtual machines and containers are connected only to vmbr1. Because have single public IP (bridge vmbr0) - I had to create NAT between vmbr0 and vmbr1 to expose services from "LAN" to a public network.

1

1 Answer 1

0
iptables -t nat -A PREROUTING -i vmbr0 -p tcp --dport 3306 -j DNAT --to-destination 10.5.0.250

Any incoming traffic on vmbr0 addressed to TCP port 3306 will get its destination address changed to 10.5.0.250.

iptables -t nat -A POSTROUTING -o vmbr1 -p tcp --dport 3306 -d 10.5.0.250 -j SNAT --to-source 10.5.0.1

Any outgoing traffic on vmbr1 with a destination IP of 10.5.0.250 and destination TCP port 3306 will get its source IP address changed to 10.5.0.1.

To which bridge is your "local traffic" connected?

Either way, with these rules, only traffic with destination port of 3306/TCP will ever be NATted: any other destination ports will be left untouched.

If the 10.5.0.* network is connected to the vmbr1 bridge (as the configuration would suggest), then these rules should have no effect at all on any traffic between 10.5.0.10 and 10.5.0.11.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .