You need to create NAT rules which tell the kernel what connections
to change, and how to change them. To do this, we use the very
versatile iptables tool, and tell it to alter the NAT table by
specifying the `-t nat' option.
The table of NAT rules contains three lists called `chains': each rule is examined in order until one matches. The two chains are called PREROUTING (for Destination NAT, as packets first come in), and POSTROUTING (for Source NAT, as packets leave). The third (OUTPUT) will be ignored here.
The following diagram would illustrate it quite well if I had any artistic talent:
_____ _____
/ \ / \
PREROUTING -->[Routing ]----------------->POSTROUTING----->
\D-NAT/ [Decision] \S-NAT/
| ^
| |
| |
| |
| |
| |
| |
--------> Local Process ------
At each of the points above, when a packet passes we look up what connection it is associated with. If it's a new connection, we look up the corresponding chain in the NAT table to see what to do with it. The answer it gives will apply to all future packets on that connection.
Thanks first to WatchGuard, and David Bonn, who believed in the netfilter idea enough to support me while I worked on it.
And to everyone else who put up with my ranting as I learnt about the ugliness of NAT, especially those who read my diary.
Rusty.
There are three official sites:
You can reach all of them using round-robin DNS via