The public IP may change after instance power cycles - stop then start (if NOT an EIP), MASQUERADE is a better option in this use case. Important: It is still possible to use MASQUERADE target with static IP, just be aware of the extra overhead. References. iptables Tutorial. NAT Tutorial. New iptables Gotchas - SNAT VS MASQUERADE
Tables: Group of chains: filter and nat; Each chain has a policy - the default target; 8 What is Masquerading? All computers appear to have the same IP This is done with Network Adress Translation It's easy to fake the "outgoing packet" "Incoming packets" must be translated too Port translation - a must NAT Gateway. This topic describes how to set up and manage a Network Address Translation (NAT) gateway. A NAT gateway gives cloud resources without public IP addresses access to the internet without exposing those resources to incoming internet connections.. Warning Avoid entering confidential information when assigning descriptions, tags, or friendly names to your cloud resources through the Step-By-Step Configuration of NAT with iptables. This tutorial shows how to set up network-address-translation (NAT) on a Linux system with iptables rules so that the system can act as a gateway and provide internet access to multiple hosts on a local network using a single public IP address. NAT: NAT servers are available on Windows 95/NT, Linux, Solaris, and some of the better ISDN routers (not Ascend) Pro: + Very configurable + No special application software needed Con: - Requires a subnet from your ISP (expensive) Network Address Translation is the name for a box that would have a pool of valid IP addresses on the Internet More Information. Due to variations in the configuration, setting, and collaboration of technical devices, the digital image colors shown here may vary from actual samples.
ip nat inside source list access-list-number pool name overload Establish dynamic source translation, identifying the access list defined in the prior step. 4 . interface type number Specify the inside interface. 5 . ip nat inside Mark the interface as connected to the inside. 6 . interface type number Specify the outside interface. 7 .
NAT Masquerade (Many-to-one) First of all lets look at configuration settings to translate a network range behind behind a single IP. set nat source rule 10 source address '192.168../16' set nat source rule 10 outbound-interface 'eth2' set nat source rule 10 protocol 'all' set nat source rule 10 translation address 'masquerade' # NAT table rules *nat :POSTROUTING ACCEPT [0:0] # Forward traffic through eth0 - Change to match you out-interface -A POSTROUTING -s 192.168.1./24 -o eth0 -j MASQUERADE # don't delete the 'COMMIT' line or these nat table rules won't # be processed COMMIT Now enable the changes by restarting ufw. $ sudo ufw disable && sudo ufw enable FORWARD iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE service iptables save service iptables restart. Note: check if iptables is set to start during boot up. Or check the status of your iptables service: chkconfig -list iptables. If level 5 is on then it's ok othewise start the service at level 5 or level 2345.
Masquerade Also known as Many-to-One NAT, PAT or NAT Overload. Source Specific translation between address(es) and/or port(s). Using Source NAT to translate the traffic from the UNMS server and LAN clients using the public IP address(es) on the WAN interface (eth0).
ip nat inside source list access-list-number pool name overload Establish dynamic source translation, identifying the access list defined in the prior step. 4 . interface type number Specify the inside interface. 5 . ip nat inside Mark the interface as connected to the inside. 6 . interface type number Specify the outside interface. 7 . Network address translation (NAT) is a method of remapping an IP address space into another by modifying network address information in the IP header of packets while they are in transit across a traffic routing device. The technique was originally used to avoid the need to assign a new address to every host when a network was moved, or when the upstream Internet service provider was replaced The rule uses the NAT packet matching table (-t nat) and specifies the built-in POSTROUTING chain for NAT (-A POSTROUTING) on the firewall's external networking device (-o eth0).POSTROUTING allows packets to be altered as they are leaving the firewall's external device. The -j MASQUERADE target is specified to mask the private IP address of a node with the external IP address of the firewall Masquerading is a special form of Source NAT where the source address is unknown at the time the rule is added to the tables in the kernel. If you want to allow hosts with private address behind your firewall to access the Internet and the external address is variable (DHCP) this is what you need to use. The masquerading will change the source IP address and port of the packets originated from the network 192.168../24 to the address 10.5.8.109 of the router when the packet is routed through it. To use masquerading, a source NAT rule with action 'masquerade' should be added to the firewall configuration: