IP - Tables NAT ens19 <> ens18

Question

I am hoping someone good with IP tables can give me some pointers.

I am attempting a DNAT with 2 interfaces, Basically what I am trying to do is anything from one interface needs to be pushed to a specific IP on the other and traffic needs to flow in both directions.

The interfaces are ens19 and ens18

ens19 has ip 10.0.0.10 and everything from 10.0.0.10 on ens19 needs to be pushed to 192.168.110.120 on ens18 then any response from 192.168.110.120 need to be pushed back to 10.0.0.10 on ens19.

What I have so far is this,

sudo iptables -t nat -A POSTROUTING -o ens18 -j MASQUERADE,
sudo iptables -A FORWARD -i ens19 -j ACCEPT,
sudo iptables -t nat -A PREROUTING -i ens19 -p tcp -j DNAT --to 192.168.120.110

Which seems to get halfway there,

Traffic on ens18

Just encase the images arent working, Here is the output from tcp dump on esn19

*nat is 192.168.120.175 ip of the ubuntu machine

10:59:28.061230 IP (tos 0x2,ECT(0), ttl 122, id 4932, offset 0, flags [DF], proto TCP (6), length 52)
    10.180.9.221.60497 > nat.502: Flags [SEW], cksum 0x005c (correct), seq 915671938, win 8192, options [mss 1200,nop,wscale 8,nop,nop,sackOK], length 0
10:59:34.064183 IP (tos 0x0, ttl 122, id 9853, offset 0, flags [DF], proto TCP (6), length 48)
    10.180.9.221.60497 > nat.502: Flags [S], cksum 0x152b (correct), seq 915671938, win 8192, options [mss 1200,nop,nop,sackOK], length 0

Here is the output from tcpdump on ens18

11:02:01.078007 IP (tos 0x2,ECT(0), ttl 121, id 4808, offset 0, flags [DF], proto TCP (6), length 52)
    nat.61244 > 192.168.120.110.502: Flags [SEW], cksum 0x2b46 (correct), seq 2455055900, win 8192, options [mss 1200,nop,wscale 8,nop,nop,sackOK], length 0
11:02:01.079093 IP (tos 0x0, ttl 64, id 64830, offset 0, flags [DF], proto TCP (6), length 44)
    192.168.120.110.502 > nat.61244: Flags [S.], cksum 0x71f0 (correct), seq 935635538, ack 2455055901, win 8192, options [mss 1460], length 0

It looks like 192.168.120.110 is responding to the request that originated on 10.0.0.10 however when I capture the traffic on ens19 I am only seeing the original request, not the response.

I have also set sysctl -w net.ipv4.ip_forward=1

edit*

The output of sudo iptables -L -n -t nat -v is

Chain PREROUTING (policy ACCEPT 3419 packets, 853K bytes)
 pkts bytes target     prot opt in     out     source               destination
  239 12428 DNAT       tcp  --  ens19  *       0.0.0.0/0            0.0.0.0/0            to:192.168.120.110

Chain INPUT (policy ACCEPT 5 packets, 388 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 81 packets, 6116 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 45 packets, 3340 bytes)
 pkts bytes target     prot opt in     out     source               destination
  275 15204 MASQUERADE  all  --  *      ens18   0.0.0.0/0            0.0.0.0/0

The output of sudo iptables -L -n -v | grep "Chain FORWARD"

Chain FORWARD (policy ACCEPT 1273 packets, 56132 bytes)

The output of iptables -L FORWARD -v is

    Chain FORWARD (policy ACCEPT 1208 packets, 53272 bytes)
     pkts bytes target     prot opt in     out     source               destination
      726 36884 ACCEPT     all  --  ens19  any     anywhere             anywhere

Appreciate the time !

*edit , I have temporally changed the IP of ens18 to 192.168.110.170 aka nat in previous captures.

Here is a capture from ens18, It looks like the PLC 192.168.110.120 is responding to a three way handshake request ( I could be wrong ) that originated from ens19 10.0.0.10 however the response isnt being returned via 10.0.0.10 on ens19.

ens18 capture

14:47:13.068871 IP 192.168.120.170.57553 > 192.168.120.110.502: Flags [SEW], seq 729326537, win 8192, options [mss 1200,nop,wscale 8,nop,nop,sackOK], length 0
14:47:13.069312 IP 192.168.120.110.502 > 192.168.120.170.57553: Flags [S.], seq 3632495411, ack 729326538, win 8192, options [mss 1460], length 0
14:47:16.015114 IP 192.168.120.110.502 > 192.168.120.170.57553: Flags [S.], seq 3632495411, ack 729326538, win 8192, options [mss 1460], length 0

ens19 capture

14:58:19.066653 IP 10.180.9.221.60553 > 10.0.0.10.502: Flags [SEW], seq 1069361213, win 8192, options [mss 1200,nop,wscale 8,nop,nop,sackOK], length 0
14:58:25.077211 IP 10.180.9.221.60553 > 10.0.0.10.502: Flags [S], seq 1069361213, win 8192, options [mss 1200,nop,nop,sackOK], length 0

Is there a way I can rout all traffic originating from 192.168.110.120 on ens18 to 10.0.0.10 on ens19 ?

*Edit ------------------------

Thanks everyone for the input, Problem solved !

Answer 1

Based on the information provided, you are preforming NAT (Network Address Translation) in the wrong direction. Currently, 192.168.120.110 does not know the proper reply address so it is incorrectly replying to 192.168.120.170. The server at 192.168.120.170 doesn't know how to deal with the packet addressed to it. By reversing the NAT direction: Delete this:

sudo iptables -t nat -A POSTROUTING -o ens18 -j MASQUERADE

And use this instead:

sudo iptables -t nat -A POSTROUTING -o ens19 -j MASQUERADE

But, myself, I would use SNAT instead of MASQUERADE whenever the IP address on the NIC is static and known:

sudo iptables -t nat -A POSTROUTING -o ens19 -j SNAT to 10.0.0.10

Because your default FORWARD policy is ACCEPT, you don't actually need this:

sudo iptables -A FORWARD -i ens19 -j ACCEPT

By the way, the time stamps on your tcpdump listings do not correlate, which is confusing. It would be good to run two instances simultaneously, in two terminals so that the time stamp can be used to help understand.

With this change you should observe similar to:

ens19 IP 10.180.9.221.60553 > 10.0.0.10.502:
ens18 IP 10.180.9.221.60553 > 192.168.120.110.502:
ens18 IP 192.168.120.110.502 > 10.180.9.221.60553:
ens19 IP 10.0.0.10.502 > 10.180.9.221.60553:
ens19 ...

And 192.168.120.110 needs to know that 192.168.120.170 (or .175) is either the default gateway or at least the gateway for IP addresses that might arrive on ens19.