Take the tour ×

I don't know how to do it, but I need a iptables rule natting my outbound traffic to as How to do it?

Just to let you know: is my target destination and is part of another network. is the IP address that my packets should come from to the gateway to achieve the target

Can someone give me an practical example?


share|improve this question
Does your system have the IP address of If not, then how are you expecting the replies to get back to you? –  Zoredache Aug 14 '12 at 18:29
add comment

migrated from stackoverflow.com Aug 14 '12 at 18:27

This question came from our site for professional and enthusiast programmers.

2 Answers

Lets say you have an interface eth0 with network where your client resides and you have another interface eth1 with IP and you can reach your destination ( using this interface

iptables -t nat -A POSTROUTING -i eth0 -d -j SNAT --to-source


iptables -t nat -A POSTROUTING -i eth0 -d -j MASQUERADE

will both work. But if you don't have an interface with the IP (eth1 has some other IP) then only the first one will work and that too ONLY if whatever IP you have on eth1 is in your next hop's routing table as the route to As the comment on your question mentions you must have as your interface IP or the router connected to you MUST know that if it needs to send stuff to it should send it towards your interface. Hope that explains it.

share|improve this answer
add comment

If you simply set up NAT on the router you are immediately behind, and make sure the subnet doesn't exist on your side of it, it will automatically treat that address as an Internet address and do NAT for you. That it is an RFC1918 address is of no consequence.

The packets will appear to come from the NAT host. If that is not, you can't do that (the packets' return path would be invalid).

However, depending on your network architecture, you may not need NAT between those subnets. It is perfectly legitimate to use a routing protocol (like RIP) and allow the routers to route between those two subnets. The only implication of using RFC1918 addresses in this case is that you can't traverse the public Internet using them; on your intranet they can be used like any other address, including for subnetting and routing.

share|improve this answer
add comment

Your Answer

