Re: NAT question

Le mercredi 25 janvier 2012 à 10:54 -0500, Stephen Clark a écrit :

Can iptables do a network to network nat without having to write out a 
bunch of nat rules.
In other words translate  192.168.198.0/24 to 172.16.10.0/24 without 
having to write out
256 rules.

Also can iptables handle 1000 nat rules like above if they have to be 
written out on
a 1.66ghz intel dual core atom with 1gb of mem.

I know this isn't appropriate question for devel list but I didn't find 
anything googling.

Thanks,

If you are forced to use 256 rules, you could split them into 16 tables
of 16 rules and do a hash split.

Since these rules are run only for new connections, it might be OK
performance wise, depending on rate of connection establishment.

If not, you can try NETMAP :)

# iptables -t nat -A POSTROUTING -s 192.168.198.0/24 -j NETMAP --to 172.16.10.0/24

# iptables -t nat -nvL POSTROUTING
Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 NETMAP     all  --  *      *       192.168.198.0/24     0.0.0.0/0           172.16.10.0/24