MAAS Network and NAT

Question

Here is the case:

1) I have a public network connected to internet LAN #1
2) I have another private network for MAAS and its DHCP and DNS , LAN #2
3) For internet connection i need to enable NAT

Question:

1) Do I need a Managed Switch to enable NAT on admin page of Switch on my private Network?

2) In which LAN , LAN #1 or LAN #2 , I must define and Enable NAT?

3) Does the enabling of NAT is something defined in Switch?

Thnaks

Answer 1

1. No, you need a router. You should define NAT rules in the admin page or in the configuration file of the router. On many routers, outbound NAT is automatically defined which will give devices on the LAN side automatic access to the Internet via 1 public address.
2. If your goal is to provide NAT'd Internet access to the the nodes and MAAS controller on the MAAS/DHCP/DNS LAN #2 network, you will need a router between LAN 2 and your network with public Internet IP addresses. The router's WAN interface would get a public Internet IP (NAT outside in Cisco land) and the router's LAN interface would get a private IP (NAT inside in Cisco land) and that private IP would be the Internet gateway address for your MAAS controller and it's nodes.
3. No, switches do not normally handle NAT.

From: http://www.iana.org/glossary

network address translation (NAT) A system of using private IP addresses within an internal network (such as within a home, and office, or even within an ISP), and then having those numbers converted into a real IP address when Internet traffic leaves that network using a specialised router. This is commonly used within homes, for example, so that users do not have to apply for an extra IP address each time they connect a device to the network. It is very similar to using “extension numbers” within an office telephone system

From:

http://www.cisco.com/c/en/us/support/docs/ip/network-address-translation-nat/26704-nat-faq-00.html

Q. How does NAT work? A. Basically, NAT allows a single device, such as a router, to act as an agent between the Internet (or public network) and a local network (or private network), which means that only a single unique IP address is required to represent an entire group of computers to anything outside their network.

Q. How do I configure NAT? A. In order to configure traditional NAT, you need to make at least one interface on a router (NAT outside) and another interface on the router (NAT inside) and a set of rules for translating the IP addresses in the packet headers (and payloads if desired) need to be configured. In order to configure Nat Virtual Interface (NVI), you need at least one interface configured with NAT enable along with the same set of rules as mentioned above.

(EDIT:) Upon further review, it seems your network needs are similar to the scenario listed at: http wiki dot cloudbase dot it/maas (I need at least 10 reputation to post more than 2 links)

That means you would need to make your Ubuntu MAAS server act as your router/firewall between it's two interfaces to allow the machines attached to the private network interface (your LAN #2) to access the Internet via the public interface (your LAN #1):

From: http://wiki.cloudbase.it/maas

Configure firewall and enable ip forwarding

/sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
/sbin/iptables -A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
/sbin/iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
echo 'net.ipv4.ip_forward=1' >> /etc/sysctl.conf
sysctl -p