How to select IP address for outgoing packets?

From: Graham Murray (gmurray_at_webwayone.co.uk)
Date: 04/28/05 

Date: Thu, 28 Apr 2005 14:44:29 +0100

For reasons which are not important here, I have a linux system (SuSE
9.3, if that makes any difference) which acts as the NAT router for a
LAN. This has 2 NICs, one of which connects to an ADSL router which
presents a /29 (the interface of this router is also using an address
within the /29)[1], the other connects to the internal LAN. All but 1 of
the 'external' addresses are NAT'd to various systems/services on the
LAN, with one of the external addresses being 'reserved' for services
running on the Linux system itself. In order to do this I have had to
associate 5 of the /29 addresses with the 'external' NIC using the
iproute2 tools.

I have no problems with routing incoming packets to the correct
system, nor with setting the correct outgoing IP address (using
iptables 'nat' table) for connections originating from other systems
on the LAN.

However I have been unable to force outgoing connections from the
Linux system to use the IP address which I want. For most things this
does not matter but I have the requirement to set up a VPN, which
requires fixed endpoint addresses, from this system. I have tried
setting the source address in the 'ip route' command, but this has no
effect. I tried setting SNAT in the iptables 'nat' OUTPUT table, but
SNAT is not valid in that table.

[1] I know that this is not the best setup, but the ISP supplied the
ADSL router and we do not have access to change its configuration.

Relevant Pages

  • Understanding voip and NAT
    ... PC on my local lan - via a NAT D-link 604 broadband router to the net, ... I have a spare linux server on this network to run some form of server etc. ...
    (Debian-User)
  • Re: Linksys WRT54G and Firewall software
    ... and it is completely unprotected on the LAN side. ... But what I have meant is that a average router is a very vulnerable ... NAT router's are not "secured" per se by default. ... NAT tries to match incoming packets to established connections and conversations. ...
    (comp.security.firewalls)
  • Re: Which home user router has a decent firewall inside it?
    ... Not for your LAN. ... The NAT translation on the router will ... NAT will inspect any packets if at all. ... public IP addresses in your LAN) and keep the firewall active. ...
    (comp.security.firewalls)
  • Re: Router with a software firewall. Is this possible?
    ... opening holes in your NAT on the router. ... computers on the LAN unless something inside the LAN opens a hole ... use a hardware router that DOESN'T put a Swiss ... >firewall to keep it all upstream of the LAN. ...
    (comp.security.firewalls)
  • Re: Router with a software firewall. Is this possible?
    ... opening holes in your NAT on the router. ... computers on the LAN unless something inside the LAN opens a hole ... use a hardware router that DOESN'T put a Swiss ... >firewall to keep it all upstream of the LAN. ...
    (comp.security.firewalls)