Given the following network:
+-- endpoint 1
|
internet -- server --+-- endpoint 2
|
+-- endpoint 3
where the endpoints are on subnet 192.168.1.0/24
and they route their traffic through the server.
For this, we require a NAT rule on the server for the interface connected to the internet:
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
Two questions:
- Packets originating on the server itself are also matched by this rule. They already have the correct source IP. What happens with them? (Experimentation shows it works.)
- I always considered the question to add
MASQUERADE
or not to be a property of the interface (because the connected network can either handle multiple source IPs or it needs a NAT). Is this a good mental model?
0 Answers