Understanding netfilter address masquerading

Understanding netfilter address masquerading

by Milan Duric -
Number of replies: 1

Dear TAs,

I am trying to fully grasp the consequences of executing the following command on PC4 node:

iptables -t nat -A PREROUTING -p icmp -s 10.10.20.2 -d 10.10.10.1 -J DNAT --to-destination 10.10.30.3

Now when I ping 10.10.10.1(PC1-eth0) from 10.10.20.2(PC2-eth0), I expectedly receive a ping request with IP destination address set to 10.10.30.3 on interface 10.10.30.3(PC3-eth0). However, if I observe interfaces PC4-eth2(10.10.30.4) and PC4-eth1(10.10.20.4), I see 2 ping replies with following properties:

PC4-eth2: Ping reply with source IP address set to 10.10.30.3 (received on PC4-eth2)
PC4-eth1: Ping reply with source IP address set to 10.10.10.1 (forwarded on PC4-eth1)

Interface PC1-eth0 and PC4-eth0 display no traffic, which is expected. This means that the PC4 node changed the source IP address of ping reply while forwarding it from interface PC4-eth2 to PC4-eth1. I am having a hard time realizing why this is the case, especially given the fact that sending a ping request from PC3 to PC2 does not result in this behavior (the source address remains 10.10.30.3 after packet forwarding on PC4).

Thanks in advance for your help and guidelines.

In reply to Milan Duric

Re: Understanding netfilter address masquerading

by Marc Fabien Egli -
Hello,

The command indeed modifies the destination IP address of a packet coming from 10.10.20.2 (PC2-eth0) and going to 10.10.10.1 (PC1.eth0). But DNAT also does the inverse operation for any reply.

Pinging in the other way (from PC3-eth0 to PC2-eth0) works because the rule does not apply and thus PC4 will not maintain an entry in the its DNAT table.
Indeed, when PC4-eth1 receives traffic from PC2-eth0 to PC1-eth0 it will redirect it, but also maintain a mapping from destination port and destination IP address to the port PC4-eth2 will use to send traffic to PC3-eth0. When PC3-eth0 replies on this port, the table is used to modify the source IP address from PC3-eth0 to PC1-eth0. 

DNAT is also more commonly known as port-forwarding. 

Marc