iptables

lol nevermind, forgot the

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Yes, you must do 3 things to properly map ports to another address using only one network interface (DNAT on the same interface), that is when you only have one interface on the iptables machine:

• change the destination IP inside each packet before routing to the end machine's IP

• change the source IP in each packet after routing to the iptables machine's IP (so that the end machine will return the IP to the iptables machine, and not the initial one)

• enable IP forwarding on the iptables machine

Here's the complete command set, considering that 64.62.231.86 is the iptables machine:

iptables -t nat -A PREROUTING -p tcp -m tcp --dport 2106 -j DNAT --to-destination 66.182.217.197:2106

iptables -t nat -A POSTROUTING -s ! 64.62.231.86 -d 66.182.217.197 -j SNAT --to-source 64.62.231.86

echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -P FORWARD ACCEPT

The first line says: all packets that enter the iptables machine on port 2106 of any IP on the iptables machine (you can restrict this to only one IP if you want) are to go to 66.182.217.197 port 2106

The second line say: all packets that leave the iptables machine and that have a source IP address diffferent from the iptables machine's IP are to be changed to the iptables machine IP. If you don't do this then the end machine at 66.182.217.197 will simply reply to the initial machine and not the iptables machine and the packet will get dropped/rejected.

The last two lines enable IP forwarding on the interfaces of the iptables machine. Without that nothing works. To have ip forwarding enabled after reboot you need to edit some /etc conf files. For debian it's /etc/network/options (set ipforward=yes), for redhat it's /etc/sysconfig/network (set FORWARDIPV4=true), for gentoo it's /etc/sysctl.conf (set net.ipv4.ip_forward=1), google for other Distros :P

If you want more details and explanations: http://www.idallen.com/oclug/2004_nat/dnat.txt