Hello, Grant Taylor a écrit :
You have to have some form of NAT for the aforementioned reason. However it is possible to do this on a layer 2 device via EBTables / IPTables with bridged netfilter traffic enabled.
Ebtables, are you sure ? AFAIK ebtables does only layer 2 MAC address translation, not IP address translation. Don't you mean bridge-nf aka bridge-netfilter instead of ebtables ?
In essence from L2 you watch for any traffic coming from the L3 IP address space in question and then NAT the L3 addresses with (on L2) to be the actual L3 address you want to appear as. The same thing happens in reverse and you tend to have what appears to be a L3 ""router, but in actuality it's purely an L2 device pretending to be / doing the function of an L3 router.
It's far from being that simple. Doing stateful IP address translation at layer 2 requires other operations such as fragment reassembly because stateful NAT operates at the datagram level, not at the packet level, and rerouting and ARP lookup when the destination IP and MAC addresses change. IMO these are definitely not layer 2 operations.
IPTables uses what is considered /stateful/ NAT. Remember when IPTables introduced connection tracking and the state match extension in 2.4 years ago? Previously IPChains did not have such state.
Ipchains did not have a state match extension, but it had some connection tracking for its NAT features (masquerading and port forwarding).
The (older ?) installs of the IP (ip) command could do /stateless/ NAT. I say older because I'm not sure that the stateless NAT provided by IP exists any more. ... (checking) ... According to the IP man page, stateless NAT is no longer supported: "Warning: Route NAT is no longer supported in Linux 2.6."
Actually the IP_ROUTE_NAT option enabling the old stateless NAT aka "fast NAT" or "route NAT" support in the kernel has been removed since kernel 2.6.9 only. But a new stateless NAT was added in kernel 2.6.24. See option NET_ACT_NAT in the "QoS and/or fair queueing" menu (yeah, I guess the location may seem misleading). I have not dug into it, but I think it can be set up with the "tc" tool from the iproute package. It requires iproute2-2.6.24-rc7 at least.
-- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
