ip.route iptable does not natIptables and SNATTrigger iptables masquerade before reaching service on gateway?OpenVPN AS accept connections forwarded by NATHow do I forward/NAT all traffic to one interface/IP to a remote IP?Linux Routing with two NICs (LAN vs Internet) with NAT and bridging for VMsIptables port forwarding with restrictions on someNated traffic don't returnIPTables Multi-VLAN NAT to Multiple IPsLEDE 17.01.1, StrongSwan 5.6.0 swanctl NATiptables NAT HTTPS on external IP to internal IP - debian
Summer '19 Sandbox error: String index out of range: 0: Source
Game artist computer workstation set-up – is this overkill?
Why would a military not separate its forces into different branches?
Playing Doublets with the Primes
How important are good looking people in a novel/story?
Can anyone identify this unknown 1988 PC card from The Palantir Corporation?
What word describes the sound of an instrument based on the shape of the waveform of its sound?
Do quaternary sulfur dications exist?
Why can’t you see at the start of the Big Bang?
Lines too long in piece with two sections for different instruments
My dual citizen son (US and Australia) wants to marry a US citizen but live in Australia
TIP120 Transistor + Solenoid Failing Randomly
Picking a theme as a discovery writer
What happens if I accidentally leave an app running and click "Install Now" in Software Updater?
Is crescere the correct word meaning to to grow or cultivate?
Reverse ColorFunction or ColorData
Can I combine SELECT TOP() with the IN operator?
How did the Force make Luke hard to hit in the Battle of Yavin?
What are these silver "sporks" for?
How to replace space with '+' symbol in a triangular array?
Transistor gain, what if there is not enough current?
What's the 2-minute timer on mobile Deutsche Bahn tickets?
How long did it take Captain Marvel to travel to Earth?
What does the copyright in a dissertation protect exactly?
ip.route iptable does not nat
Iptables and SNATTrigger iptables masquerade before reaching service on gateway?OpenVPN AS accept connections forwarded by NATHow do I forward/NAT all traffic to one interface/IP to a remote IP?Linux Routing with two NICs (LAN vs Internet) with NAT and bridging for VMsIptables port forwarding with restrictions on someNated traffic don't returnIPTables Multi-VLAN NAT to Multiple IPsLEDE 17.01.1, StrongSwan 5.6.0 swanctl NATiptables NAT HTTPS on external IP to internal IP - debian
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;
|--------------| |--------------| |--------------|
| computer A | eth0| computer B | | computer C |internet
| (10.5.0.2) |----------| (10.5.0.1) | | (x.x.x.x) |--------
| | | | | ^ |
| | | NAT | | | NAT | |
| | | ˇ | tun0 | |
| | | (10.8.0.14) |----------| (10.8.0.1) |
|--------------| |--------------| |--------------|
Here the schematic of the network I've build.
My problem is when I try to configure the NAT in the B computer
''bash
root@computerB#cat /proc/sys/net/ipv4/ip_forward
1
root@computerB# iptables-save
*nat
:PREROUTING ACCEPT [13:1108]
:INPUT ACCEPT [10:600]
:OUTPUT ACCEPT [6708:457650]
:POSTROUTING ACCEPT [5782:389727]
-A POSTROUTING -o wlan0 -j MASQUERADE
COMMIT
# Completed on Sat Apr 27 23:56:29 2019
# Generated by iptables-save v1.6.0 on Sat Apr 27 23:56:29 2019
*filter
:INPUT ACCEPT [1235765:1640284761]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [759264:248481682]
-A FORWARD -i eth0 -j ACCEPT
COMMIT
# Completed on Sat Apr 27 23:56:29 2019
- when I whant to ping 10.5.0.1 from computer A it's work
- when I whant to ping 10.8.0.14 from computer A it's work
when I whant to ping 10.8.0.1 from computer A it's not working
so i take my friend wireshark and start to listen on tun0 I can see packets like thatNo. time mac source destination protocol length info
285 106.310258 N/A 10.5.0.2 10.8.0.1 ICMP 84 Echo (ping) request id=0x8114, seq=0/0, ttl=63 (no response found!)
I don't understand why I get ip 10.5.0.2 on interface tun0
nat debian-stretch
asked Apr 27 at 22:33
Colin ROUBAUDColin ROUBAUD
12
add a comment |
|--------------| |--------------| |--------------|
| computer A | eth0| computer B | | computer C |internet
| (10.5.0.2) |----------| (10.5.0.1) | | (x.x.x.x) |--------
| | | | | ^ |
| | | NAT | | | NAT | |
| | | ˇ | tun0 | |
| | | (10.8.0.14) |----------| (10.8.0.1) |
|--------------| |--------------| |--------------|
Here the schematic of the network I've build.
My problem is when I try to configure the NAT in the B computer
''bash
root@computerB#cat /proc/sys/net/ipv4/ip_forward
1
root@computerB# iptables-save
*nat
:PREROUTING ACCEPT [13:1108]
:INPUT ACCEPT [10:600]
:OUTPUT ACCEPT [6708:457650]
:POSTROUTING ACCEPT [5782:389727]
-A POSTROUTING -o wlan0 -j MASQUERADE
COMMIT
# Completed on Sat Apr 27 23:56:29 2019
# Generated by iptables-save v1.6.0 on Sat Apr 27 23:56:29 2019
*filter
:INPUT ACCEPT [1235765:1640284761]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [759264:248481682]
-A FORWARD -i eth0 -j ACCEPT
COMMIT
# Completed on Sat Apr 27 23:56:29 2019
- when I whant to ping 10.5.0.1 from computer A it's work
- when I whant to ping 10.8.0.14 from computer A it's work
when I whant to ping 10.8.0.1 from computer A it's not working
so i take my friend wireshark and start to listen on tun0 I can see packets like thatNo. time mac source destination protocol length info
285 106.310258 N/A 10.5.0.2 10.8.0.1 ICMP 84 Echo (ping) request id=0x8114, seq=0/0, ttl=63 (no response found!)
I don't understand why I get ip 10.5.0.2 on interface tun0
nat debian-stretch
asked Apr 27 at 22:33
Colin ROUBAUDColin ROUBAUD
12
1
Route, don't NAT.
– Michael Hampton♦
Apr 27 at 22:35
NAT is not a substitute for routing. Those are two completely different things.
– Ron Maupin
Apr 27 at 22:40
1
What name has interface with 10.8.0.14? wlan0 or tun0?
– Jigius
Apr 28 at 2:06
my interface with 10.8.0.14 is tun0
– Colin ROUBAUD
Apr 28 at 11:13
add a comment |
|--------------| |--------------| |--------------|
| computer A | eth0| computer B | | computer C |internet
| (10.5.0.2) |----------| (10.5.0.1) | | (x.x.x.x) |--------
| | | | | ^ |
| | | NAT | | | NAT | |
| | | ˇ | tun0 | |
| | | (10.8.0.14) |----------| (10.8.0.1) |
|--------------| |--------------| |--------------|
Here the schematic of the network I've build.
My problem is when I try to configure the NAT in the B computer
''bash
root@computerB#cat /proc/sys/net/ipv4/ip_forward
1
root@computerB# iptables-save
*nat
:PREROUTING ACCEPT [13:1108]
:INPUT ACCEPT [10:600]
:OUTPUT ACCEPT [6708:457650]
:POSTROUTING ACCEPT [5782:389727]
-A POSTROUTING -o wlan0 -j MASQUERADE
COMMIT
# Completed on Sat Apr 27 23:56:29 2019
# Generated by iptables-save v1.6.0 on Sat Apr 27 23:56:29 2019
*filter
:INPUT ACCEPT [1235765:1640284761]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [759264:248481682]
-A FORWARD -i eth0 -j ACCEPT
COMMIT
# Completed on Sat Apr 27 23:56:29 2019
- when I whant to ping 10.5.0.1 from computer A it's work
- when I whant to ping 10.8.0.14 from computer A it's work
when I whant to ping 10.8.0.1 from computer A it's not working
so i take my friend wireshark and start to listen on tun0 I can see packets like thatNo. time mac source destination protocol length info
285 106.310258 N/A 10.5.0.2 10.8.0.1 ICMP 84 Echo (ping) request id=0x8114, seq=0/0, ttl=63 (no response found!)
I don't understand why I get ip 10.5.0.2 on interface tun0
nat debian-stretch
asked Apr 27 at 22:33
Colin ROUBAUDColin ROUBAUD
12
|--------------| |--------------| |--------------|
| computer A | eth0| computer B | | computer C |internet
| (10.5.0.2) |----------| (10.5.0.1) | | (x.x.x.x) |--------
| | | | | ^ |
| | | NAT | | | NAT | |
| | | ˇ | tun0 | |
| | | (10.8.0.14) |----------| (10.8.0.1) |
|--------------| |--------------| |--------------|
Here the schematic of the network I've build.
My problem is when I try to configure the NAT in the B computer
''bash
root@computerB#cat /proc/sys/net/ipv4/ip_forward
1
root@computerB# iptables-save
*nat
:PREROUTING ACCEPT [13:1108]
:INPUT ACCEPT [10:600]
:OUTPUT ACCEPT [6708:457650]
:POSTROUTING ACCEPT [5782:389727]
-A POSTROUTING -o wlan0 -j MASQUERADE
COMMIT
# Completed on Sat Apr 27 23:56:29 2019
# Generated by iptables-save v1.6.0 on Sat Apr 27 23:56:29 2019
*filter
:INPUT ACCEPT [1235765:1640284761]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [759264:248481682]
-A FORWARD -i eth0 -j ACCEPT
COMMIT
# Completed on Sat Apr 27 23:56:29 2019
- when I whant to ping 10.5.0.1 from computer A it's work
- when I whant to ping 10.8.0.14 from computer A it's work
when I whant to ping 10.8.0.1 from computer A it's not working
so i take my friend wireshark and start to listen on tun0 I can see packets like thatNo. time mac source destination protocol length info
285 106.310258 N/A 10.5.0.2 10.8.0.1 ICMP 84 Echo (ping) request id=0x8114, seq=0/0, ttl=63 (no response found!)
I don't understand why I get ip 10.5.0.2 on interface tun0
nat debian-stretch
nat debian-stretch
asked Apr 27 at 22:33
Colin ROUBAUDColin ROUBAUD
12
asked Apr 27 at 22:33
Colin ROUBAUDColin ROUBAUD
12
edited Apr 28 at 11:18
Colin ROUBAUD
asked Apr 27 at 22:33
Colin ROUBAUDColin ROUBAUD
12
asked Apr 27 at 22:33
Colin ROUBAUDColin ROUBAUD
12
asked Apr 27 at 22:33
Colin ROUBAUDColin ROUBAUD
12
12
1
Route, don't NAT.
– Michael Hampton♦
Apr 27 at 22:35
NAT is not a substitute for routing. Those are two completely different things.
– Ron Maupin
Apr 27 at 22:40
1
What name has interface with 10.8.0.14? wlan0 or tun0?
– Jigius
Apr 28 at 2:06
my interface with 10.8.0.14 is tun0
– Colin ROUBAUD
Apr 28 at 11:13
add a comment |
1
Route, don't NAT.
– Michael Hampton♦
Apr 27 at 22:35
NAT is not a substitute for routing. Those are two completely different things.
– Ron Maupin
Apr 27 at 22:40
1
What name has interface with 10.8.0.14? wlan0 or tun0?
– Jigius
Apr 28 at 2:06
my interface with 10.8.0.14 is tun0
– Colin ROUBAUD
Apr 28 at 11:13
1
1
Route, don't NAT.
– Michael Hampton♦
Apr 27 at 22:35
Route, don't NAT.
– Michael Hampton♦
Apr 27 at 22:35
NAT is not a substitute for routing. Those are two completely different things.
– Ron Maupin
Apr 27 at 22:40
NAT is not a substitute for routing. Those are two completely different things.
– Ron Maupin
Apr 27 at 22:40
1
1
What name has interface with 10.8.0.14? wlan0 or tun0?
– Jigius
Apr 28 at 2:06
What name has interface with 10.8.0.14? wlan0 or tun0?
– Jigius
Apr 28 at 2:06
my interface with 10.8.0.14 is tun0
– Colin ROUBAUD
Apr 28 at 11:13
my interface with 10.8.0.14 is tun0
– Colin ROUBAUD
Apr 28 at 11:13
add a comment |
1 Answer
1
active
oldest
votes
As explained in the comments, you should not do NAT here. You should use just regular IP routing.
However, to fix the issue with NAT, change
-A POSTROUTING -o wlan0 -j MASQUERADE
to
-A POSTROUTING -o tun0 -j MASQUERADE
in your IPTables rules.
answered Apr 30 at 5:30
Tero KilkanenTero Kilkanen
20.7k22744
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f964887%2fip-route-iptable-does-not-nat%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
As explained in the comments, you should not do NAT here. You should use just regular IP routing.
However, to fix the issue with NAT, change
-A POSTROUTING -o wlan0 -j MASQUERADE
to
-A POSTROUTING -o tun0 -j MASQUERADE
in your IPTables rules.
answered Apr 30 at 5:30
Tero KilkanenTero Kilkanen
20.7k22744
add a comment |
As explained in the comments, you should not do NAT here. You should use just regular IP routing.
However, to fix the issue with NAT, change
-A POSTROUTING -o wlan0 -j MASQUERADE
to
-A POSTROUTING -o tun0 -j MASQUERADE
in your IPTables rules.
answered Apr 30 at 5:30
Tero KilkanenTero Kilkanen
20.7k22744
add a comment |
As explained in the comments, you should not do NAT here. You should use just regular IP routing.
However, to fix the issue with NAT, change
-A POSTROUTING -o wlan0 -j MASQUERADE
to
-A POSTROUTING -o tun0 -j MASQUERADE
in your IPTables rules.
answered Apr 30 at 5:30
Tero KilkanenTero Kilkanen
20.7k22744
As explained in the comments, you should not do NAT here. You should use just regular IP routing.
However, to fix the issue with NAT, change
-A POSTROUTING -o wlan0 -j MASQUERADE
to
-A POSTROUTING -o tun0 -j MASQUERADE
in your IPTables rules.
answered Apr 30 at 5:30
Tero KilkanenTero Kilkanen
20.7k22744
answered Apr 30 at 5:30
Tero KilkanenTero Kilkanen
20.7k22744
answered Apr 30 at 5:30
Tero KilkanenTero Kilkanen
20.7k22744
answered Apr 30 at 5:30
Tero KilkanenTero Kilkanen
20.7k22744
20.7k22744
add a comment |
add a comment |
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f964887%2fip-route-iptable-does-not-nat%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
1
Route, don't NAT.
– Michael Hampton♦
Apr 27 at 22:35
NAT is not a substitute for routing. Those are two completely different things.
– Ron Maupin
Apr 27 at 22:40
1
What name has interface with 10.8.0.14? wlan0 or tun0?
– Jigius
Apr 28 at 2:06
my interface with 10.8.0.14 is tun0
– Colin ROUBAUD
Apr 28 at 11:13