IPTables: NAT multiple IPs to one public IP

Posted by Kaemmelot on Server Fault See other posts from Server Fault or by Kaemmelot
Published on 2013-07-27T15:45:35Z Indexed on 2014/08/19 4:23 UTC
Read the original article Hit count: 466

Filed under:
|

I'm looking for a way how to nat 2 or more inner IPs (in my case xen doms) to one outer IP.
I tried to use

iptables -t nat -A PREROUTING -d 123.123.123.123 -j DNAT --to 1.2.3.4 --to 1.2.3.7
iptables -t nat -A POSTROUTING -s 1.2.3.4 -j SNAT --to 123.123.123.123
iptables -t nat -A POSTROUTING -s 1.2.3.7 -j SNAT --to 123.123.123.123

And got an error:

iptables v1.4.14: DNAT: Multiple --to-destination not supported
Try `iptables -h' or 'iptables --help' for more information.

I found this in the manpage:

Later Kernels (>= 2.6.11-rc1) don't have the ability to NAT to multiple ranges anymore.

So my question is: Why is it not possible anymore and is there a workaround? Maybe I should use an other method I don't know yet?

EDIT:
The idea is to use the system like a router, so I have one address but multiple users behind. The problem is I don't know which connection reffers to a user (for example 1.2.3.4). But I know, they all have different ports open for incomming traffic.
So my solution (for DNAT) would be to nat all incoming connections to all users and filter all unused ports, so the connection goes to one single user. For outgoing traffic I would use

iptables -A FORWARD -i eth0 -d 1.2.3.4 -m state --state ESTABLISHED,RELATED -j ACCEPT

© Server Fault or respective owner

Related posts about iptables

Related posts about nat