Hello,
Grant Taylor a écrit :
Pedro Gonçalves wrote:
I want to know if it is possible to use IPTables to implement
-Full Cone NAT
-Restricted Cone NAT
-Port Restricted Cone NAT
-Symmetric NAT
I see no reason why it would not be possible.
The reason is Netfilter/iptables performs UDP NAT on a per-connection
basis (connection = source address, source port, destination address,
destination port).
"Full Cone Nat" could easily be implemented with inbound redirection to
the internal system.
"Full cone NAT" can be implemented with 1-to-1 bidirectional NAT using
SNAT+DNAT or NETMAP.
"Port Restricted Cone NAT" is nothing more than "Restricted Cone NAT"
with port filtering. This is what is usually done if you have a server
behind a NATing router / firewall. In this case, you only port forward
the ports that you need.
No. Please read more carefully the definitions of "restricted cone NAT"
and "port restricted cone NAT". Neither can be implemented with iptables
because they do not fit in the per-connection model.
I'm not sure if there is inherent support for "Symmetric NAT" or not.
"Symmetric NAT" works on a per-connection basis and is the NAT form that
is the easiest to implement with iptables using SNAT or MASQUERADE.
