2

I have a challenging situation where I have 5 devices which act as wireless access points. I need to be able to access TCP 8080 on each device from a central device. All wireless devices have a 192.168.122.1 address and dish out a DHCP address over wireless. I have a Pi connected via 5 wireless cards (on a powered hub) as so....

enter image description here

Ideally I want to connect to eth0 on the Pi nic on ports 8081,8082 etc and be NAT'd to each of the different devices on port 8080. I looked into namespaces but my wireless cards don't support it so I need to find a solution with ip route / iptables. Been thrashing around for a few days and haven't found a good example to work from. Some help would be appreciated.

Thanks

Arushix
  • 1,290
poperob
  • 121
  • 1
    Take a look at this Q&A, you need to do something like this - https://unix.stackexchange.com/questions/21093/output-traffic-on-different-interfaces-based-on-destination-port. – slm Jul 12 '18 at 01:06

1 Answers1

0

I'm not an iptables expert by any means but this is what finally worked with help from this article suggested above from Arushix.

#!/bin/bash

#flush routes
ip route flush 192.168.122.0/24
ip route flush 192.168.122.1
ip route flush default via 192.168.122.1

#flush iptables
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
iptables -t nat -F
iptables -t mangle -F
iptables -F
iptables -X

#NAT'd packet responses sent back to the eth0 ip
iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source 192.168.2.38
iptables -t nat -A POSTROUTING -j MASQUERADE

#Add a separate routing table and firewall mark for each incoming port  
ip rule add fwmark 4 table 4

#mark the packets
iptables -t mangle -A PREROUTING -p tcp --dport 8084 -j MARK --set-mark 4

#route through the appropriate interface    
ip route add 192.168.122.0/24 dev wlan4 table 4

#packets to 8084 nat'd to device 8080
iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 8084 -j DNAT --to-destination 192.168.122.1:8080

#turn off spoofing protection
sysctl -w net.ipv4.conf.eth0.rp_filter=0

#do it for all the interfaces 
ip rule add fwmark 3 table 3
iptables -t mangle -A PREROUTING -p tcp --dport 8083 -j MARK --set-mark 3
ip route add 192.168.122.0/24 dev wlan3 table 3
iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 8083 -j DNAT --to-destination 192.168.122.1:8080  

ip rule add fwmark 2 table 2
iptables -t mangle -A PREROUTING -p tcp --dport 8082 -j MARK --set-mark 2
ip route add 192.168.122.0/24 dev wlan2 table 2
iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 8082 -j DNAT --to-destination 192.168.122.1:8080

ip rule add fwmark 1 table 1
iptables -t mangle -A PREROUTING -p tcp --dport 8081 -j MARK --set-mark 1
ip route add 192.168.122.0/24 dev wlan1 table 1
iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 8081 -j DNAT --to-destination 192.168.122.1:8080
poperob
  • 121