does IPTABLES as a router always require masquerade / SNAT?

Question

If I set up a linux box as a router behind a DSL gateway, do I need to enable masquerading or SNAT?

Logically I would assume that all I need to do is enable ip_forwarding (done) but traffic to Internet dies if I don't perform any NATing.

The config is as follows (apologies for diagram)

Internet---[ppp0_DSL router_eth0]----192.168.1.x-----[eth0_ubunturouter_eth1]------192.168.2.x

If NAT is running on the broadband router, then would I also need it running on the ubuntu router?

Below is the config of the ubuntu router iptables...

  # Generated by iptables-save v1.4.21 on Thu Oct 29 12:48:19 2015
*nat
:PREROUTING ACCEPT [10859:2328892]
:INPUT ACCEPT [1002:126271]
:OUTPUT ACCEPT [1256:91484]
:POSTROUTING ACCEPT [638:43890]
COMMIT
# Completed on Thu Oct 29 12:48:19 2015
# Generated by iptables-save v1.4.21 on Thu Oct 29 12:48:19 2015
*filter
:INPUT ACCEPT [5:803]
:FORWARD ACCEPT [127:18532]
:OUTPUT ACCEPT [5:431]
# INPUT to allow ssh and ping from internal network
-A INPUT -i eth1 -p tcp -m tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT -m comment --comment "ssh on eth1"
-A INPUT -p icmp -j ACCEPT -m comment --comment "allow ping from internal"
-P INPUT DROP
# god table to handle traffic forwarding and test icmp
-N god
-A god -d 8.8.4.4 -j REJECT
-A god -d 8.8.8.8 -j DROP
# forward configured to explicitly route between interfaces - this could be redundant
-A FORWARD -i eth1 -o eth0 -j ACCEPT
-A FORWARD -i eth0 -o eth1 -j ACCEPT
-A FORWARD -p tcp -j ACCEPT -m comment --comment "all tcp"
-A FORWARD -p udp -j ACCEPT -m comment --comment "all udp"
-A FORWARD -p icmp -j god -m comment --comment "all icmp"
-A FORWARD -i eth0 -j ACCEPT
-A FORWARD -i eth1 -j ACCEPT
-P FORWARD DROP
# output to allow web traffic and icmp from router
-A OUTPUT -o eth1 -p tcp -m tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 53 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -p icmp -j ACCEPT
-P OUTPUT DROP
COMMIT
# Completed on Thu Oct 29 12:48:19 2015

This config keeps killing the Internet, but it always works if I include

-A POSTROUTING -o eth0 -j SNAT --to 192.168.1.1

But why??? Why does this box work only with SNAT, which is not needed because its already in place on the DSL router?

• • • • • • • • UPDATED - - - - - - -

As seen in the comments, Radhil and MichaelB are both correct. I am failing to take into account the lack of routing on the broadband router for anything other than one subnet (192.168.1.0 in this instance). Unfortunately this particular broadband router provides no means of adding additional static routes, so my solution for enabling source based routing from the internal subnet in this instance is to use the PREROUTING tables to chain the traffic.

eg

A PREROUTING -i eth1 -m mac --mac-source xx:xx:xx:xx:xx:xx -j DNAT --to 192.168.2.200

then

-A FORWARD -s 192.168.2.200 -j DROP

This is obviously a lousy solution (done this way as IPTABLES does not allow one to DROP within the PREOUTING / POSTROUTING tables, but I've just included it as an example of being able to route based on source within these straitened circumstances.

Answer 1

The DSL router is running it's own NAT on 192.168.1.0, correct? That's the network it's set to hand out.

So the answer would be that it doesn't know anything about any 192.168.2.0 network, and therefore doesn't attempt to NAT it. It may forward that trafficout to the Internet, but the Internet will drop those private IPs right away. It probably also doesn't have routing information to get back through your box to your 2nd network segment, so you would have no return path anyway, unless you set that up as a static route somewhere and didn't point it out.

So you need to give the DSL router something it's expecting. Either find a way to change settings on it to NAT both segments and a static route to your Ubuntu for 192.168.2.0, or set up the NAT on yours like you found.

Answer 2

This is because the DSL modem doesn't know about the 192.168.2.* network, when the router receives a packet from 192.168.2.x it is presuming it must reply through the default gateway, because it has no specific route to that subnet.

If your DSL router is capable of being configured with a static route, then that will fix it, if not, you'll need to have NAT configured on the router, so that all traffic that the router sees originates from the local network (as far as the DSL router sees)