How to NAT between 2 network interfaces without impacting routing

Question

My Linux-based router has 5 Ethernet ports. It is currently acting as a router between ports 1 & 2 and the dedicated WAN port, without NAT. Port 1 is 192.168.1.1/24, port 2 is 192.168.2.1/24, WAN port is 192.168.0.1/24.

The outgoing WAN connection goes through a logging device that keeps track of usage, then goes through a second home router that does NAT, and uses a public IP on its WAN port.

To simplify, the network is as follow, with the IP prefix 192.168.-:

server1--------Router1--------Logging device--------Router2----------
   .1.2      .1.1  .0.1                           .0.254  (public ip)

Router1 configuration works well (that's a simple router), Router2 as well (that's a simple gateway). However I would like to remove Router2, and have my NAT done between ports 3 & 4 of Router1, with port4 using my real public IP.

Would that be feasible? I would like to maintain strict isolation between ports 1-2-WAN and 3-4, to make sure all traffic goes through the logging device (with its original IP source address).

Would Transparent bridging be the solution? Could I apply source NAT to this bridge? Is the IP addressing done well?

Answer 1

Assuming your 5 ethernet ports on router1 are named eth0 - eth4, hence having the WAN on eth3:

iptables -t nat -A POSTROUTING --source 192.168.1.0/24 --out-interface eth3 -j MASQUERADE
iptables -t nat -A POSTROUTING --source 192.168.2.0/24 --out-interface eth3 -j MASQUERADE

If you have a fixed IP as your public IP address then replace "-j MASQUERADE" with "-j SNAT --to-source $PUBLIC_IP" (of course replace $PUBLIC_IP with your WAN address!).

Of course you will need to set your default route to eth3, but that wasn't part of the question. You'll also want to firewall incoming traffic into the public IP address.