Combine MASQUERADING and NETMAP in iptables POSTROUTING

Flo

6/2/24, 12:59 PM

We have some clients (networks) which are connected via VPN to our server network. Let's say client has e.g. 192.168.0.1/32 and our server network is on 10.1.0.0/24.

So the issue now with this client is, that they're already using the 10.1.0.0/24 themselvs, so we cannot have our range on the clients side. Please note, that configuring the clients network is not in our hand.

To avoid issues, we decided to map our network with the following iptables rule

NETMAP     all  --  any    any     10.1.0.0/24        192.168.0.1          to:192.168.101.0/24

for simplicity i skip the other direction aswell as the swanctl configuration details, but connection works both ways.

So far everything is fine for us in this setup.

Now on top of that we have another network, lets says 192.168.1.0/24 which needs to have access to this client and all other sites available from 10.1.0.0/24 - but not the other way round.

So to avoid adding the route everywhere on all the VPNs and servers, we use

MASQUERADE  all  --  any    ens18   192.168.1.0/24      anywhere

to replace the source IPs.

Both rules are on the VPN Gateway, the MASQUERADE rule comes first.

So as far as i understand, the MASQUERADE rule in my setup on the POSTROUTING chain is terminating and is the only rule which will be applied during POSTROUTING from incoming packages from 192.168.1.0/24. Is that correct?

This would mean, that there is no way to have my packages MASQUERADING and NETMAP 'ed in one step? Does anyone have an alternative approach for this issue?

127

0 + 3

networking

linux

iptables

masquerade

anx

6/2/24, 1:24 PM

IIRC messy address conflicts were mostly sorted in 1998. Any good reason to not just use the unwanted complexity as an excuse to entirely discontinue cross-network IPv4 traffic?

anx

6/2/24, 1:36 PM

From the description I do not immediately see how the nat PREROUTING and POSTROUTING chains (thats two) are too few to apply both source and destination address translation (also two). Which routing, encapsulation or translation step is causing the trouble?

Flo

6/2/24, 1:50 PM

@anx to sum up, i need two `SNAT` rules if you want to put it that way. First i need to have `192.168.1.0/24` to `10.1.0.0/24` (MASQUERADING uses the VPN /32 here) and `10.1.0.0/24` to `192.168.101.0/24`.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Combine MASQUERADING and NETMAP in iptables POSTROUTING

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.