Ranged 1:1 NAT with iptables

Posted on 2011-10-10
Last Modified: 2012-05-12
I currently have two networks that I need to be able to talk to each other via a 1:1 NAT situation. I have a CentOS machine running iptables with a nic on each network, and would like to NAT a range of IP addresses between the two networks.
Even if it's a manual process rather than a couple of ranged commands, that's okay - I'm just struggling to get this working.

Basically, i'm trying to NAT 10.0.0.x/24 <--> 172.16.0.x/24

IPTables machine:

Computer A:
Computer B:

From computer A, I would like to be able to ping and that be mapped to computer B's IP,, and vice versa. If computer B pings, that should be mapped to computer A @
Is this possible with iptables to begin with, and what's the best way of going about this?

Question by:vixtro
    LVL 16

    Accepted Solution

    Your problem is a bit more complex, because you want to NAT LAN addresses. The steps needed are:
    1. configure ethernet aliases for additional IPs that the CentOS machine should NAT
    2. configure NAT in iptables
    3. allow the packets with firewall

    1. For the above example you should add two virtual interfaces:
     eth0:0 with IP
     eth1:0 with IP

     See chapter 13.2.4. in

    2. You should configure NAT - you have to do this for each IP, but since you can do this with iptables command-line commands you could write a bash  script that would add a range of IPs

     For the above example:
     iptables -t nat -A PREROUTING -d -j DNAT --to-destination
     iptables -t nat -A PREROUTING -d -j DNAT --to-destination

     When doing "ping" from machine A you probably want to see on the machine B as the source IP and not, so you should  add also:
     iptables -t nat -A POSTROUTING -s -j DNAT --to-source
     iptables -t nat -A POSTROUTING -s -j DNAT --to-source

    3. The firewall should allow packet traversal. This includes enabled packet forwarding and firewall allowing packets:

     echo 1 > /proc/sys/net/ipv4/ip_forward

     iptables -t filter -A FORWARD -d -j ACCEPT
     iptables -t filter -A FORWARD -d -j ACCEPT
    LVL 1

    Author Comment

    Thanks for your reply Blaz,

    Your post got me 99% of the way there, although I did have to change one thing along the way.
     iptables -t nat -A POSTROUTING -s -j DNAT --to-source
     iptables -t nat -A POSTROUTING -s -j DNAT --to-source

    These two lines caused issues - I kept getting "Unknown arg --to-source", which makes sense as it's trying to do a DNAT to a source. So, i changed DNAT to SNAT so the lines read
     iptables -t nat -A POSTROUTING -s -j SNAT --to-source
     iptables -t nat -A POSTROUTING -s -j SNAT --to-source

    and that works as expected.
    I have verified that the aliases and forwarding works as expected, as when I shutdown the network interfaces on computer A when pinging from computer B, the ping stops, and resumes when the interfaces come back up.
    Thanks for your help!
    LVL 16

    Expert Comment

    Sorry for that - it was a typo.

    I'm glad that you got it working.

    Featured Post

    How to improve team productivity

    Quip adds documents, spreadsheets, and tasklists to your Slack experience
    - Elevate ideas to Quip docs
    - Share Quip docs in Slack
    - Get notified of changes to your docs
    - Available on iOS/Android/Desktop/Web
    - Online/Offline

    Join & Write a Comment

    Hello EE, Today we will learn how to send all your network traffic through Tor which is useful to get around censorship and being tracked all together to a certain degree. This article assumes you will be using Linux, have a minimal knowledge of …
    BIND is the most widely used Name Server. A Name Server is the one that translates a site name to it's IP address. There is a new bug in BIND (, affecting all versions of BIND 9 from BIND 9.1.0 (inclusive) thro…
    To add imagery to an HTML email signature, you have two options available to you. You can either add a logo/image by embedding it directly into the signature or hosting it externally and linking to it. The vast majority of email clients display l…
    Illustrator's Shape Builder tool will let you combine shapes visually and interactively. This video shows the Mac version, but the tool works the same way in Windows. To follow along with this video, you can draw your own shapes or download the file…

    754 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    19 Experts available now in Live!

    Get 1:1 Help Now