On Fri, 2 May 2014, kzhm@mailtor.net wrote:
*) dark iptables nat magic
You can do source+destination NAT (aka "hairpinning") using only the iptables command, which is often installed already on most Linux boxes. This is the equivalent of having a port-forwarding TCP proxy.
Assuming your external-facing interface is eth0, you want to forward your local TCP port 5432 to the remote IP 2.3.4.5 on port 6789, this would be:
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 5432 -j DNAT --to-destination 2.3.4.5:6789
iptables -t nat -A POSTROUTING -d 2.3.4.5 -o eth0 -j MASQUERADE
You also need to enable IP forwarding, which can be done in a distribution specific way, or directly with:
sysctl net.ipv4.ip_forward=1
Can I announce an address that isn't directly mine? Can I use my address for outbound traffic to the next relay or do I need to use the "bridge address" for that?
I don't know about the announcements, though.
-- Aaron