Simulating NAT with two Linux boxes

I needed to test some master-slave software in a situation that the master communicated to the slave over NAT (master’s IP address was replaced with the firewall’s external address), and then NAT would be removed, keeping master and slave addresses the same, but the slave would see the master directly.

This is the test scenario that worked on my desk, without having to add any routing to the LAN.

atom02 is the computer that emulates the slave system. It is connected back-to-back to alix102, and has only one IP address to communicate to:

ip link set dev eth0 up
ip addr add 192.168.1.50/31 dev eth0

alix102 is a Linux box with multiple Ethernet ports: eth0 is connected to my home LAN and has a DHCP address 192.168.1.142/24. Also eth1 (192.168.1.51/31) is connected directly to atom02.

The following configuration makes alix102 answer to ARP requests for 192.168.1.50 and forward packets to atom02, replacing the source address with 192.168.1.51. Also atom02 can make an SSH connection to 192.168.1.51:3022 and it will be connected to another box in the LAN that emulates the software master (192.168.1.147:22).

# enable IP forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward
# Bring up eth1
ip link set dev eth1 up
ip addr add 192.168.1.51/31 dev eth1
# Enable proxy ARP on eth0
echo 1 > /proc/sys/net/ipv4/conf/eth0/proxy_arp
# Set up the NAT translation
iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to 192.168.1.51
iptables -t nat -A PREROUTING -p tcp --dport 3022 -i eth1 -j DNAT --to 192.168.1.147:22

After that, atom02 can be re-connected directly into the LAN, keeping the address 192.168.1.50 with /24 network mask, and the software can be tested with direct communication. Alix102 has to be disconnected from the LAN, so that it does not pollute it with proxy ARP responses.

Advertisements

  1. Leave a comment

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: