Balancing Load with iptables SNAT/DNAT on Debian Routers – A Practical Guide

1. Route Forwarding and SNAT Experiment

Environment: a Debian machine inside the network (eth1 172.16.1.2) and a router (eth1 192.168.1.1, eth2 192.168.1.2). When the network card is correctly configured, Debian can ping 172.1.6.1 but cannot reach any external address; however it can ping the router’s eth1 address 192.168.1.2.

Solution: add an SNAT rule on the router to translate the source address 172.1.6.1 to 192.168.1.2, allowing outbound traffic.

echo 1 > /proc/sys/net/ipv4/ip_forward

iptables -t nat -A POSTROUTING -s 172.1.6.1 -j SNAT --to-source 192.168.1.2

2. DNAT Experiment

Environment: the same router (192.168.1.2) and an external network (192.168.1.124). The Debian host cannot communicate with the external network directly.

Solution: add a DNAT rule on the router to translate destination traffic destined for 192.168.1.124 to the internal Debian address 172.1.6.1.

iptables -t nat -A PREROUTING -d 192.168.1.124 -j DNAT --to-destination 172.1.6.1

3. Load‑Balancing and NAT Experiment

Environment: the Debian router is configured with four IP addresses and must forward traffic to four external networks. An nginx instance is used to return the client’s IP, proving that the load‑balancing works.

Configuration steps (simplified):

# Set up four external IPs on the router
ifconfig eth0 172.1.6.1 netmask 255.255.255.0 up
ifconfig eth0:1 172.1.6.2 netmask 255.255.255.0 up
ifconfig eth0:2 172.1.6.3 netmask 255.255.255.0 up
ifconfig eth0:3 172.1.6.4 netmask 255.255.255.0 up

# Enable IP forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward

# SNAT rule for outbound traffic
iptables -t nat -A POSTROUTING -s 172.1.6.0/24 -j SNAT --to-source 192.168.1.2

# DNAT rules for inbound traffic to the four back‑ends
iptables -t nat -A PREROUTING -d 192.168.1.124 -j DNAT --to-destination 172.1.6.1
iptables -t nat -A PREROUTING -d 192.168.1.125 -j DNAT --to-destination 172.1.6.2
iptables -t nat -A PREROUTING -d 192.168.1.126 -j DNAT --to-destination 172.1.6.3
iptables -t nat -A PREROUTING -d 192.168.1.127 -j DNAT --to-destination 172.1.6.4

After applying the rules, the router can forward traffic to the four back‑ends, and the nginx server reports the client IP correctly, confirming successful load‑balancing and NAT.