NAT fun! - do these two lines do the same thing?

[stu2000]

Can someone tell me the difference between the next two lines?

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to-source <server-ip-here>

iptables --table nat --append POSTROUTING --out-interface eth0 -j MASQUERADE

Im guessing that the first line only affects packets that come in on 10.8.0.x and makes the packet look like it originated from this server.

Im also guessing that the second line forwards all packets it recieves out through the eth0 device. Does the MASQUERADE bit make the packet appear as if it originated from this server just like in the first line?

Stu

[Lazydog]

It all depends on how you are looking at them. As they are written they both do something different.

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to-source <server-ip-here>

This rule is applied to all packets leaving the firewall and is not looking at the direction. In other words all packets are set to the ip address assigned no matter if they are leaving eth0 or eth1. All packets will have the source address of the assigned ip for that interface that is is exiting through.

iptables --table nat --append POSTROUTING --out-interface eth0 -j MASQUERADE

Says all packets leaving out eth0 should be re-addressed with the servers ip address of that interface.

[stu2000]

thanks for that. The last point was interesting. I didnt realise that. I guess that makes the first rule pretty dumb, as it would make all the packets recieved appear as if they originated from the server. If you applied an outward direction and interface eth0 to the first rule, they would do the same thing but the first would cost less resources right (assuming you had static instead of dynamic ip)? doesnt have to look up ip every time.

[Lazydog]

Some say you should use SNAT when you know the IP Address. I use MASQ all the time. It is simple and effective all the time. And should the server happen to be moved and re-addressed I don't have to remember to make any changes to the firewall rule.

[stu2000]

Thanks again! Id give you a +1 but there doesnt appear to be any type of rating system on here