What is the correct iptables rule when NATing multiple private subnets?
Posted
by
Jose Mendez
on Server Fault
See other posts from Server Fault
or by Jose Mendez
Published on 2014-08-21T02:27:06Z
Indexed on
2014/08/21
4:22 UTC
Read the original article
Hit count: 516
I have a Centos minimal 6.5 acting as a router. eth0 is connected to a Cisco switch trunk port, allowing VLANs 200-213.
I have several VLAN interfaces just as this link suggests:
And have IPv4 forwarding, so all my network devices from any of the networks 200-213 can communicate with each other using this linux box as their router.
Problem is, I need them to access the Internet, so I added the following rule:
iptables -t nat -A POSTROUTING -s 192.168.0.0/16 -j SNAT --to 1.1.1.56
1.1.1.56 is the "outside" address. This works fine, devices connected to the internal networks can ping Intertnet addresses BUT, they stop being able to talk to each other across subnets, so 192.168.211.55 can ping 8.8.8.8, but can't talk to 192.168.213.5.
As soon as I do a service iptables restart to remove the rule, I can start talking across internal subnets again.
What would be the correct way to set up NAT for multiple private subnets? Or maybe the correct way to set up forwarding?
© Server Fault or respective owner
