Home / server / Questions / 536750
Accepted
hraphrap
Asked: 2013-09-06 12:12:10 +0800 CST

Port forwarding to the local network machines for local network users

  • 772

All machines in my network based on linux. Main server has 192.168.0.1, mail server has 192.168.0.2, client machine has 192.168.0.3 ip.

I've added

iptables -t nat -A PREROUTING -d 192.168.0.1 -p tcp -m tcp --dport 25 -j DNAT --to-destination 192.168.0.2:25

at main server, because i want all clients work with my main server on smtp.

But i think, that this solution doesn't work because when mail server 192.168.0.2 decides to send packet back to client (192.168.0.3), it does it without help of gateway (192.168.0.1) because it's a local network.

How to force 192.168.0.2 send all the packages through the gateway?

iptables

1 Answers

  1. Best Answer

    You are correct that the packages will be sent back to the source address and not thru 192.168.0.1.

    iptables -t nat -A POSTROUTING -p tcp --dport 25 -j SNAT --to-source 192.168.0.1

    This will make all connections seem to come from 192.168.0.1 if they go thru it, and thus the packets will go back the same way.

    One disadvantage with this might be that the real server will not know the original IP.

    If the original IP is a issue it is possible to create a separate subnet (say 192.168.220.0/30 - mask will only allow ip 1 and 2) and route the traffic over, one additional routing table is needed to get the traffic to flow correctly from the smtp server for the return packages after coming in on that address.

    • 1