I am hoping someone good with IP tables can give me some pointers.
I am attempting a DNAT with 2 interfaces, Basically what I am trying to do is anything from one interface needs to be pushed to a specific IP on the other and traffic needs to flow in both directions.
The interfaces are ens19 and ens18
ens19 has ip 10.0.0.10 and everything from 10.0.0.10 on ens19 needs to be pushed to 192.168.110.120 on ens18 then any response from 192.168.110.120 need to be pushed back to 10.0.0.10 on ens19.
What I have so far is this,
sudo iptables -t nat -A POSTROUTING -o ens18 -j MASQUERADE,
sudo iptables -A FORWARD -i ens19 -j ACCEPT,
sudo iptables -t nat -A PREROUTING -i ens19 -p tcp -j DNAT --to 192.168.120.110
Which seems to get halfway there,
Just encase the images arent working, Here is the output from tcp dump on esn19
*nat is 192.168.120.175 ip of the ubuntu machine
10:59:28.061230 IP (tos 0x2,ECT(0), ttl 122, id 4932, offset 0, flags [DF], proto TCP (6), length 52)
10.180.9.221.60497 > nat.502: Flags [SEW], cksum 0x005c (correct), seq 915671938, win 8192, options [mss 1200,nop,wscale 8,nop,nop,sackOK], length 0
10:59:34.064183 IP (tos 0x0, ttl 122, id 9853, offset 0, flags [DF], proto TCP (6), length 48)
10.180.9.221.60497 > nat.502: Flags [S], cksum 0x152b (correct), seq 915671938, win 8192, options [mss 1200,nop,nop,sackOK], length 0
Here is the output from tcpdump on ens18
11:02:01.078007 IP (tos 0x2,ECT(0), ttl 121, id 4808, offset 0, flags [DF], proto TCP (6), length 52)
nat.61244 > 192.168.120.110.502: Flags [SEW], cksum 0x2b46 (correct), seq 2455055900, win 8192, options [mss 1200,nop,wscale 8,nop,nop,sackOK], length 0
11:02:01.079093 IP (tos 0x0, ttl 64, id 64830, offset 0, flags [DF], proto TCP (6), length 44)
192.168.120.110.502 > nat.61244: Flags [S.], cksum 0x71f0 (correct), seq 935635538, ack 2455055901, win 8192, options [mss 1460], length 0
It looks like 192.168.120.110 is responding to the request that originated on 10.0.0.10 however when I capture the traffic on ens19 I am only seeing the original request, not the response.
I have also set sysctl -w net.ipv4.ip_forward=1
edit*
The output of sudo iptables -L -n -t nat -v
is
Chain PREROUTING (policy ACCEPT 3419 packets, 853K bytes)
pkts bytes target prot opt in out source destination
239 12428 DNAT tcp -- ens19 * 0.0.0.0/0 0.0.0.0/0 to:192.168.120.110
Chain INPUT (policy ACCEPT 5 packets, 388 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 81 packets, 6116 bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 45 packets, 3340 bytes)
pkts bytes target prot opt in out source destination
275 15204 MASQUERADE all -- * ens18 0.0.0.0/0 0.0.0.0/0
The output of sudo iptables -L -n -v | grep "Chain FORWARD"
Chain FORWARD (policy ACCEPT 1273 packets, 56132 bytes)
The output of iptables -L FORWARD -v
is
Chain FORWARD (policy ACCEPT 1208 packets, 53272 bytes)
pkts bytes target prot opt in out source destination
726 36884 ACCEPT all -- ens19 any anywhere anywhere
Appreciate the time !
*edit , I have temporally changed the IP of ens18 to 192.168.110.170 aka nat in previous captures.
Here is a capture from ens18, It looks like the PLC 192.168.110.120 is responding to a three way handshake request ( I could be wrong ) that originated from ens19 10.0.0.10 however the response isnt being returned via 10.0.0.10 on ens19.
ens18 capture
14:47:13.068871 IP 192.168.120.170.57553 > 192.168.120.110.502: Flags [SEW], seq 729326537, win 8192, options [mss 1200,nop,wscale 8,nop,nop,sackOK], length 0
14:47:13.069312 IP 192.168.120.110.502 > 192.168.120.170.57553: Flags [S.], seq 3632495411, ack 729326538, win 8192, options [mss 1460], length 0
14:47:16.015114 IP 192.168.120.110.502 > 192.168.120.170.57553: Flags [S.], seq 3632495411, ack 729326538, win 8192, options [mss 1460], length 0
ens19 capture
14:58:19.066653 IP 10.180.9.221.60553 > 10.0.0.10.502: Flags [SEW], seq 1069361213, win 8192, options [mss 1200,nop,wscale 8,nop,nop,sackOK], length 0
14:58:25.077211 IP 10.180.9.221.60553 > 10.0.0.10.502: Flags [S], seq 1069361213, win 8192, options [mss 1200,nop,nop,sackOK], length 0
Is there a way I can rout all traffic originating from 192.168.110.120 on ens18 to 10.0.0.10 on ens19 ?
*Edit ------------------------
Thanks everyone for the input, Problem solved !
sudo iptables -L -n -t nat -v
to your question. What is the default policy of the forwarding chain? (sudo iptables -L -n -v
| grep "Chain FORWARD")iptables -L FORWARD -v
. I limited thePREROUTING
rule to a dedicated port for testing. is you routing correct? (defaullt route via ens19 and the DGW is reachable? )192.168.110.175
. Suggest you use-n
in your tcpdump command. I think this rule:sudo iptables -t nat -A POSTROUTING -o ens18 -j MASQUERADE
should be this:sudo iptables -t nat -A POSTROUTING -o ens19 -j MASQUERADE
. But I would do this:sudo iptables -t nat -A POSTROUTING -o ens19 -j SNAT to 10.0.0.10
. And as already mentioned192.168.110.120
needs to know the default gateway is192.168.110.175
. I assume the WAN is via 10.0.0.10. (?)