D
D
Dmitriy Loginov2019-01-11 14:38:48
linux
Dmitriy Loginov, 2019-01-11 14:38:48

Correct iptables rule?

One network card - enp1s0 looks to the Internet, the other enp3s0 to the local network 192.168.1.0/24
Which rule is better and more correct to use for NATa local network?
All three work for me.

  1. iptables -t nat -A POSTROUTING -o enp1s0 -j ​​MASQUERADE
  2. iptables -t nat -A POSTROUTING -o enp1s0 -j ​​SNAT --to-source IP_GATEWAY
  3. iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -j MASQUERADE

Answer the question

In order to leave comments, you need to log in

1 answer(s)
P
pcdesign, 2019-01-11
@pcdesign

iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -j SNAT --to-source IP_GATEWAY

One such rule is enough if IP_GATEWAY does not change.
masqueradeeach time it determines the external address for each new connection, naturally this affects the speed of the network, with a short-term loss of the link, it masqueraderesets all open connections, because assumes that the address has already changed. masquerademakes sense when IP_GATEWAY is dynamic.

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question