Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win


iptables SNAT not working for reply packets

Posted on 2004-09-13
Medium Priority
Last Modified: 2012-05-05
I've the following setup

    L1                            L3
     |                             |
     |[ ]        |[]        
___|________________ |_______________172.16.0.0/16
            | eth0 [ ]
 -------- L2 --------- ( Firewall )
            | eth1 [ ]

Now what I need is
1. should be able to access any machine in network with a single IP exposed, so I've
iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to
and thats working fine.
2. From network should only access service's of network which will be port forwarded by L2, so I've
iptables -t nat -A PREROUTING -p tcp -i eth1 --dport 80 -j DNAT --to
and thats working fine.
3. From network one should not be able to access any machine of directly.
For that I've not added any special rule, as what i think is the rule  I've added in point 1 , should work for that too as when somebody try to ping a machine from W2K machine  to  say L1 the reply will be always matched by that rule defined in point 1 and a reply should never reach to W2K machine.

Am I wrong here ?..., as this is not happening ..ping from W2K to L1 or L3  is working fine. Why its like that ?
Do I need to explicitly block the forwarding of packets from eth1 to eth0 ?

My default Policies are -
iptables -P INPUT DROP


Question by:macv
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
LVL 40

Expert Comment

ID: 12044335
> Do I need to explicitly block the forwarding of packets from eth1 to eth0 ?

Yes. What you'll want to do is to use a default DENY stance for the FORWARD chain and explicitly permit traffic to

Author Comment

ID: 12051424
But that way somebody can direclty access , i want the complete hidden behind firewall , No direct access, only through port forwarding.

Can you explain why
 iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to
won't block the traffic going from  network to network ?
LVL 40

Expert Comment

ID: 12055923
>  But that way somebody can direclty access

Only if you permit it. You can, in the FORWARD rule, restrict the traffic to be just what you are port forwarding (80/tcp).

To say why machines in can touch machines in the network I'd need to see all of your iptables rules.

Author Comment

ID: 12062063
here is the script which i use to create the iptalble : -  ( actually i've create it by modifying ur iptables-gw ) :
#--------- start ---------
iiptables -F
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
iptables -F -t mangle
iptables -F -t nat
iptables -X
iptables -P INPUT DROP

iptables -N firewalled
iptables -A firewalled -m limit --limit 15/minute -j LOG --log-prefix Firewalled:
iptables -A firewalled -j DROP

iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to

iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j DNAT --to

iptables -A INPUT -i lo -j ACCEPT

iptables -A INPUT -i eth0 -d -j ACCEPT

iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

iptables -A INPUT -j firewalled
#---------- End --------

Well i am confused how other rule does matter, when rule -
   iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to
says that every packet going out through eth1 should have a source address translation to and that should include a case when a packet is send from network as reply against a ping request made from network i.e. reply packet should have a source address whereas we are expecting a packet from 172.16.x.x and that should show a packet loss ... shouldn't be it like this?

LVL 40

Accepted Solution

jlevie earned 200 total points
ID: 12066094
With the rules you have the only ping that makes sense from a node in (say is 'ping'. Your firewall rules don't block icmp and is visible. However if you have routes set on the nodes in telling them to reach IP's in the network via (which would be a bad idea in this case) you might be able to ping with the rule set you are using (I haven't tested that).

The SNAT rule you are using only applies to connections initiated from a node in Their outbound packet will have a source IP of

Featured Post

Tech or Treat!

Submit an article about your scariest tech experience—and the solution—and you’ll be automatically entered to win one of 4 fantastic tech gadgets.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I have seen several blogs and forum entries elsewhere state that because NTFS volumes do not support linux ownership or permissions, they cannot be used for anonymous ftp upload through the vsftpd program.   IT can be done and here's how to get i…
Note: for this to work properly you need to use a Cross-Over network cable. 1. Connect both servers S1 and S2 on the second network slots respectively. Note that you can use the 1st slots but usually these would be occupied by the Service Provide…
If you're a developer or IT admin, you’re probably tasked with managing multiple websites, servers, applications, and levels of security on a daily basis. While this can be extremely time consuming, it can also be frustrating when systems aren't wor…
This lesson discusses how to use a Mainform + Subforms in Microsoft Access to find and enter data for payments on orders. The sample data comes from a custom shop that builds and sells movable storage structures that are delivered to your property. …
Suggested Courses

604 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question