Questions tagged [nat]
In computer networking, Network Address Translation (NAT) is the process of modifying IP address information in IPv4 headers while in transit across a traffic routing device.
340
questions
0
votes
0
answers
27
views
How to make all Windows network interfaces visible (and usable ) in WSL2?
I'm a student, I'm currently working on a project with the goal of integrating MultiPath TCP (MTCP) into WSL2. However, there's a significant challenge we're facing: WSL2 only exposes a single "...
- 1
0
votes
0
answers
64
views
How is it possible that NAT doesn't back translate packets?
I have the following topology
and from myhost I can ping router2 but can't ping router1.
With tcpdump I can observe how my pings go and I see that both router1 and router2 reply. But only replies ...
- 3,191
0
votes
1
answer
12
views
nftables counter for nat'ed traffic
When setting up a counter for a rule in a 'type nat hook prerouting' chain with dnat on a specific port, the counter will only count the initial packet for that rule and the following packets from ...
1
vote
1
answer
30
views
Can nftables perform postrouting matching on crgroupv2?
I would like to change source address of every packet generated by a process in given cgroup (version 2). Is that even possible?
I have:
nftables 1.0.2,
linux 5.15 (Ubuntu variant)
/system.slice/...
- 135
1
vote
1
answer
91
views
Packet flow in linux NAT enabled on bridge IP assigned interfaces
On My Linux machine, I have following configuration:
br0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
ether bc:e6:7c:51:20:6b txqueuelen 1000 (Ethernet)
br0.1: flags=4163<...
- 113
0
votes
0
answers
41
views
IPTABLES Routing traffic from 192.168.1.1 port 21516 to 192.168.2.3 port 80
I am using Debian/Linux Bullseye (version 11)
What I am trying to accomplish is setting up a TabloTV to portfoward through a Linux firewall using IPTABLES. my linux firewall has two ethernet cards (...
- 1
0
votes
0
answers
75
views
iptables rules for transit packets port forwarding (NAT) in both directions (still accepting packets to the current server)
I wrote such rules for forwarding all ports to another server and back, but I don't like that I reserve port 10000 for this.
If you do not specify the port, then when receiving requests from 62.105.38....
- 101
0
votes
0
answers
26
views
Why do my TCP connections fail when UDP/ICMP work with policy routing setup?
I have a very nasty problem where I cannot wrap my head around. My goal is to separate my main routing table from the default gateway by putting the default gateway in a separate table (so I can later ...
- 168
1
vote
1
answer
158
views
How to configure port forwarding with nftables for a Minecraft server on Raspberry Pi?
Since I'm using a transparent proxy service, I use a raspberry pi as my home router. Its OS is plain Raspbian. Now I'm setting up a Minecraft server on 192.168.2.28, and am exposing it to WAN using ...
- 137
1
vote
1
answer
163
views
Nftables: Dnat with source address restriction and just one map
Our router machine has multiple public IPs (/27) on its WAN interface. Now, I want to add dnat rules which match specific dport/saddr/daddr combinations.
My dream would be something like this:
map ...
- 23
0
votes
1
answer
102
views
Enable NAT with TCPMSS using UFW
I could enable NAT using UFW with following configuration.
*nat
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 192.168.141.0/24 -o ens192 -j MASQUERADE
COMMIT
If I want to enable TCPMSS, I have to run ...
- 31
1
vote
1
answer
234
views
Set up NAT between Docker networks
My goal is to run two Docker containers on separate networks and have my host (Ubuntu 22.04) perform NAT so that the first network can reach the second.
My setup:
docker network create network1
docker ...
- 697
1
vote
1
answer
186
views
nftables anonymous map for ipv6 dnat
When creating a dnat rule, you can specify the following command:
nft 'add rule ip twilight prerouting ip daddr 1.2.3.0/24 dnat ip prefix to ip daddr map { 1.2.3.0/24 : 2.3.4.0/24 }'
And then get ...
0
votes
1
answer
216
views
Using ssh reverse tunnel as gateway to reach machine under NAT
I'd like to reach a machine under a network with NAT and without port forwarding.
The machine "closed" behind the no-port-forwarding NAT is called RaspberryB.
This machine create a reverse ...
- 11
0
votes
1
answer
41
views
Access VM from LAN
On a Linux laptop, I want to give access to locally hosted VM (kvm) from LAN.
I'd like to do DNAT to VM.
Network
client <-- LAN 192.168.3.0/24 --> host <-- bridge 192.168.113.0/24 --> ...
- 51
1
vote
1
answer
60
views
Fedora VM behind NAT can not ping host.domain name on intranet
I am using VirtualBox on Windows now.
The network is roughly like this:
[Fedora 37 VM] -- NAT network -- [Windows Host] ---- intranet ---- internet
I use DNS on intranet to resole host.domain names ...
- 215
0
votes
0
answers
132
views
How to redirect VM DNS question to host machine localhost dnsmasq
My local network shcema is something like this:
internet (WAN)
|
router host IP (resolv.conf)
| |
+------- eth0 - br0 - tap0 - VM (resolv.conf)
| |
...
- 1,170
0
votes
0
answers
24
views
Linux user specific virtual networks
We have a linux environment that is used by a number of users. Those users use some software that sends and receives udp socket data. We currently have a configuration file that allows specifying the ...
- 1
0
votes
1
answer
64
views
Is my local traffic being NAT-ed?
I have two iptables rules like this:
# vmbr0 - WAN bridge, vmbr1 - LAN bridge
iptables -t nat -A PREROUTING -i vmbr0 -p tcp --dport 3306 -j DNAT --to-destination 10.5.0.250
iptables -t nat -A ...
- 729
0
votes
1
answer
56
views
Mysql user connects from gateway IP after turning on port redirection on NAT
I have two containers on virtualization host that has "LAN" bridge (vmbr1) and "WAN" bridge (vmbr0).
Virtualization host has public IP (lets assume dummy 123.123.123.123) ...
- 729
0
votes
1
answer
657
views
nftables dnat in input chain
I'm trying to redirect all traffic arriving on the firewall on ports 80 and 443 to 10.133.8.11.
I gather from this that NATting in an input chain should be possible. But it seems that dnat is not. ...
- 411
0
votes
0
answers
55
views
How to connect to a subnet through a VPN
I imagine that this is very simple question, but i cannot find the answer. I am completely new in this and do not know how to start.
I have two computers which are connected through a EdgeVPN. Their ...
- 11
1
vote
0
answers
281
views
Adding a working ipv6 nat to an existing ipv4 nat
I like to add ipv6 to an existing an working ipv4 nat. It is a proxmox host and the clients are vms.
I tried to get it working by adding corresponding files on the nat device (proxmox host).
The file /...
- 251
0
votes
1
answer
728
views
wireguard server MAQUERADE/SNAT low iptables traffic statistics
I have set up my home Ubuntu 22.04 server as a wireguard server. I connect to it from a Ubuntu 22.04 laptop wireguard client, from the internet through my home network firewall to the wireguard server,...
1
vote
0
answers
28
views
Why is my browser showing me the wrong site when I put in a certain IP - but just over wifi?
ADDITIONAL Information: My ISP wifi router is a second DHCP server (since I can not disable it). The problem just comes up when I am connected via wifi. If I am connected via ethernet it works well so ...
- 427
0
votes
0
answers
16
views
VPN IPTables how to nat 10.8.a.b to 10.0.a.b?
The problem -- Translate 10.8.a.b to 10.0.a.b ?
I have a VPN setup to a bastion host. I'm attempting to map 10.8.0.0/17 into 10.0.0.0/17 so that the IP address 10.8.1.1 gets mapped to 10.0.1.1 in my ...
- 131
0
votes
0
answers
19
views
Can you explain how my external IP works with these nftable rules?
My server (under my control) is connected to a Cisco router (not under my control)
It is Debian linux server
My Server IP: 10.119.248.14 (in /etc/network/interfaces)
My ISP have given me 14.139.114....
0
votes
0
answers
123
views
How to solve "nf_ct_sip: dropping packet: all ports in use for SDP media"?
Our debian based router lately has issues with NAT regarding SIP. I know that NAT and SIP do not play nicely together but nf_ct_sip does a good job.
Recently I get a lot of "nf_ct_sip: dropping ...
- 51
0
votes
1
answer
323
views
How to hairpin a whole network segment?
I am trying to set up hairpinning on my home network following an article and a previous question. My network is below, host B serves a few services, let's settle for SSH port 22)
The reason for the ...
- 1,455
0
votes
0
answers
119
views
NAT does not route traffic from client
I have configured NAT(eth1) and client(eth0) at 10.70.1.0/24 with iptables rules and ip forwarding. NAT should route traffic from client to puplic internet(eth0), but it seems there is no traffic.
NAT ...
- 1
0
votes
0
answers
48
views
IPTables: DNAT working for every port I define except 443 (HTTPS)
My IPTables already had content inside it that I'm not sure what generated it.
I'm tying to point traffic with specific ports to an internal bridge adapter for a virtual machine.
Every port I have ...
0
votes
0
answers
126
views
DNAT to-destination on interface IP
Imagine I have a two IP addresses:
eth0: 1.2.3.4
eth0:0 1.2.3.5
gre1 10.0.0.2
so I have a traffic from gre1 and I want to use DNAT to destination eth0:0 IP address.
But it's not working
I am ...
- 1
0
votes
1
answer
266
views
How a transparent proxy knows the original destination address of DNATed packet?
I have two machines: machine A and machine B.
Machine A routes all the traffic through the machine B.
On machine A I set these iptables rules:
iptables -t nat -A PREROUTING -i wlan0 -j DNAT --to-...
- 123
1
vote
0
answers
157
views
Specify interface address as condition for nftables dnat rule
I have three interfaces:
lan0: 192.168.1.1
dmz0: 192.168.2.1
wan0: 192.168.3.123
wan0 receives its IP through DHCP. I'd like to create a dnat rule for tcp ports 80 and 443 which should match on any ...
- 411
1
vote
1
answer
287
views
Why my IPVS didn't change source IP when response packet returned
I have a k8s node named edge1, which have two pods, one is a client pod named net-tool-edge1 and one is service pod named nginx-edge1. There is also a service named nginx
For some reason, this node ...
- 53
0
votes
0
answers
323
views
IPtables DNAT with linux bridges (no interface addresses)
I've been doing some experimenting with iptables and bridges, and this scenario is just in a lab, but I've encountered some interesting functionality and would like some explanation as to what is ...
user432564
0
votes
0
answers
371
views
How to route traffic from 2 NIC's on the same PC and more about configuring a switch?
Hey everyone! I hope you guys can help me with a problem I have been struggling with. So, the image describes a network architecture. The PC is running Ubuntu 20.04 Desktop.
Port 1 and 2 = Public ...
- 1
0
votes
1
answer
505
views
Virtualbox NAT network not showing in Linux
I am currently Running a Bare Metal Kali with Virtualbox installed on it to the run Kioptrix Level 1.
I created a NAT network in preferences with the default recommendations.
This did resolve an ...
- 5
0
votes
1
answer
501
views
macos monterey: PF load anchor syntax error
I am trying to make a NAT interface to connect tap0 to the internet for QEMU. So far I've made a bridge and connected tap0 to it:
sudo ifconfig bridge1 create
sudo ifconfig bridge1 addm tap0
sudo ...
1
vote
1
answer
616
views
GRE IP to virtual machine (Proxmox) - Traceroute showing full route
88.198.49.xxx = Hetzner (will run virtual machines on this)
141.94.176.xxx = OVH (contains block below)
164.132.xxx.0/28 = IP block to use on Hetzner as virtual machines
To get GRE set up I ran the ...
- 2,903
1
vote
4
answers
849
views
Can a NAT router run out of ports?
The highest TCP port number is 65535. If a router doing NAT uses an ephemeral port for each connection made to the internet on behalf of the hosts on the internal network, does this mean that it is ...
- 2,546
1
vote
1
answer
249
views
Undoing full cone NAT using IPtables for IPsec
I currently have a free VPS hosted in Oracle Cloud. This machine sits in a so-called "Virtual Cloud Network", which is just a virtual LAN with an address in the range of 10.0.0.0/8 (10.0.0....
0
votes
1
answer
110
views
Iptables - Wifi Router User Sessions to OpenVPN in VM
The goal is to route wireless user sessions from a TP-Link TL-WR902AC Wifi travel router on the same LAN to an OpenVPN Client in a virtual machine.
My attempt at this is based on previous successful ...
- 1
1
vote
1
answer
265
views
Local transparent proxy SSLSplit causes forwarding loop
I am trying to debug an application which sends RPCs via HTTPS. In order to read the actual RPC content, I am trying to use SSLSplit on the same machine as the application to MITM the connection. To ...
- 113
0
votes
1
answer
118
views
How to restrict DNAT to just one of the public IPs?
On a hypervisor with multiple public IPs on a single network interface, there are two groups of Virtual Machines.
Group A members get their public IP routed to them directly via the host interface (...
- 181
1
vote
0
answers
22
views
Why does my virtualbox gateway duplicate SYN packets?
I'm trying to set up port knocking using iptables on a Debian server hosted by VirtualBox on my Ubuntu machine. For some reason, when I knock on a port on the server from the host machine, this knock ...
- 11
0
votes
0
answers
630
views
Redirect trafic to host toward an internal VM with nftables does not works
My issue is the following :
On an ubuntu 20 host . i got some multipass hypervisor and VMs, that i want to be able to reach from the outside.
physical host : eth1 192.168.10.33/16
vm : mpqemubr0 10....
- 1
0
votes
1
answer
26
views
On CentOS when I statically assign on ip address to my second interface , my primary nat interface does not work
When I statically assign an IP address to my second interface , my primary NAT interface does not work. I am new to Cent OS and I am using NAT and when I change the second interface statically , my ...
- 11
1
vote
1
answer
4k
views
iptables forward traffic from/to wireguard
Consider the following setup. I have a VPS that is connected to the internet, having a fixed IP. Further, in my home network, behind a NAT router, I do have my home network with several hosts. My home ...
- 490
0
votes
1
answer
315
views
IPTables - 2 Nics - Private - Public - Private route
I have a CentOS 7 with 2 NICs (enp1s0 - private LAN 192.168.0.0/24 and enp0s29u1u1 - public) that I use as a gateway / router via iptables. All PCs on the private LAN connect to the internet via the ...
- 1