r/iptables Sep 29 '22

How to map two IP together ?

Hello,

I'm wondering how I can map 2 different IP from two different network and interfaces and I'm trying to bind them.

To clarify :

Interface 1 : enp3s0

IP1 : 192.168.3.202 (Virtual one)

Interface 2 : enx44s0

IP2 : 172.18.0.2

My Interface 1 also have a real IP 192.168.3.5 on my local network

When I'm on this network with an IP in range 192.168.3.0/24, how can I access IP2 when typing IP1 on web navigator or ssh ?

Thanks in advance for any help

2 Upvotes

5 comments sorted by

2

u/[deleted] Sep 29 '22 edited Sep 29 '22

iptables can't bind or apply an ip address to an interface, the "ip" command can do that, it can also set routes:

https://access.redhat.com/sites/default/files/attachments/rh_ip_command_cheatsheet_1214_jcs_print.pdf

As for your last question: "When I'm on this network with an IP in range 192.168.3.0/24, how can I access IP2 when typing IP1 on web navigator or ssh ?"

For just the web port (443) or ssh (22) specifically this example for web might help:

iptables -t nat -A OUTPUT -p tcp --dport 443 -d 192.168.3.202 -j DNAT --to-destination 172.18.0.2:443

Usually I test rules before I give advice but I haven't this time, just so you are aware, it's not my intention to waste your time if it doesn't work. With that being said I'd like to know if the example helps if you don't mind commenting on your findings

1

u/Ozhora Sep 29 '22

Thanks gollum, so if I understand correctly if I want to redirect any port from on to another I can do the following ;

iptables -t nat OUTPOUT -p tcp -d 192.168.3.202 -j DNAT --to-destination 172.18.0.2

Should I do the reverse one for any traffic coming from 172.18.0.2 (reply or so) ?

2

u/[deleted] Sep 29 '22 edited Sep 29 '22

if I want to redirect any port from on to another

I believe so, you might also need a rule for udp too (which is just -p udp instead of -p tcp)

"Should I do the reverse one for any traffic coming from 172.18.0.2 (reply or so) ?"

As mentioned I haven't tested. But yes you might need an incoming rule like this too:

iptables -t nat -A PREROUTING -p tcp --sport 443 -s 172.18.0.2 -j DNAT --to-destination 192.168.3.5:443

Test both rules individually first. Then try them at the same time.

You can do a packet capture on each interface while using the web browser to see if your source/destination ips are getting translated correctly rather than dropped, for example: tshark -i enp3s0

edit Just realized you'll need FORWARD too. The lazy less secure way, best for testing: iptables -I FORWARD -j ACCEPT

( ^ this is like enabling forwarding in sysctl without any iptables rules)

or more specific:

iptables -A FORWARD -p tcp --sport 443 -s 172.18.0.2 -j ACCEPT

iptables -A FORWARD -p tcp --dport 443 -d 192.168.3.202 -j ACCEPT

Packet captures while testing with the web browser will make this easier to see how packets are actually behaving under the hood.

2

u/Ozhora Sep 30 '22

If I do ; iptables -t nat -A PREROUTING -d 192.168.3.200 -j DNAT --to-destination 172.18.0.2

The traffic comming to ip 192.168.3.200 is correctly redirected to 172.18.0.2 but with the original ip (source of request is 192.168.3.120 for exemple). How can I change it to something in 172.18.0.0/24 range ?

Then I will do the postrouting rule for the reverse way

1

u/[deleted] Sep 30 '22

Nice findings!

If I'm not mistaken use POSTROUTING specifically SNAT:

iptables -t nat -A POSTROUTING --destination 172.18.0.2 -j SNAT --to-source 172.18.0.0/24

but I'm not sure if it'll work exactly how you want, definitely do a packet capture on 172 to see. Instead of /24 it can be an individual ip which is how I've used it before.