Iptables massive 1:1 NAT
I have to connect two LANs: LAN1: 10.10.0.0/16 and LAN2: 192.168.0.0/16. I can't do simple routing, because 192.168.0.0/16 net is prohibited in LAN1, so I am thinking of using Full cone nat (1:1) to translate 192.168.x.y/16 to 10.11.x.y/16. Each translation is done by this rules:
iptables -t nat -A PREROUTING -d 10.11.0.0/16 -j DNAT --to-destination 192.168.0.0/16
iptables -t nat -A POSTROUTING -s 192.168.0.0/16 -j SNAT --to-source 10.11.0.0/16
But I will have to enter 254*254*2 rules, what will, I think, result in enormous performance degradation. So, is there a way to write such one-to-one translation with minimum number of rules?
I am not sure if it is present in all kernels, but what you may be looking for is the NETMAP target.
From the iptables man page
NETMAP
This target allows you to statically map a whole network of
addresses onto another network of addresses. It can only be
used from rules in the nat table.
--to address[/mask]
Network address to map to. The resulting address will be
constructed in the following way: All 'one' bits in the
mask are filled in from the new 'address'. All bits that
are zero in the mask are filled in from the original
address.
Like the first answer said, use -j NETMAP:
# iptables -t nat -A PREROUTING -d 10.11.0.0/16 -j NETMAP --to 192.168.0.0/16
# iptables -t nat -A POSTROUTING -s 192.168.0.0/16 -j NETMAP --to 10.11.0.0/16
It's probably a good idea to add -d 10.10.0.0/16 in the POSTROUTING row as well.