Feature request: Masquerading for additional IP-addresses

Erik Franzén · #1 (**permalink**) 04-04-2009, 10:11 PM

Currently (v7.401 and earlier) it is impossible to select Masquerading for additional IP addresses, it is only possible to choose the nics' main IP addresses.

The workaround is to use snat, but it is a nightmare if you have many nics and vpn:s.

BAlfson · #2 (**permalink**) 04-04-2009, 11:33 PM

Erik, I think Masquerading works with an interface, so it takes whatever address is on the interface. Are there other products that allow masquerading not on the primary IP?

You didn't say what you want to accomplish, but have you considered policy routing? What about using VLANs instead of Additional Addresses (I don't know if that will work, I'm just ideating)?

Anyway, it will be interesting to learn the solution you find.

Cheers - Bob

Erik Franzén · #3 (**permalink**) 04-05-2009, 06:56 AM

"Erik, I think Masquerading works with an interface, so it takes whatever address is on the interface. Are there other products that allow masquerading not on the primary IP?"

Let say that you have three nics with IP adresses A, B and C.
A is external and there you have an additional IP adress D.

On network B and C you have two webservers, one on each network. Masquerading on external for net B is as usual. However, you cannot set up Masquerading for net C using the additional IP address D on the external interface.

Gert Hansen · #4 (**permalink**) 04-05-2009, 01:11 PM

hi there,

this is work in progress and should be part of the next feature update.

regards
Gert

t-work · #5 (**permalink**) 04-16-2009, 02:15 AM

Quote:

Originally Posted by Gert Hansen

hi there,

this is work in progress and should be part of the next feature update.

regards
Gert

This sounds great! We have asked for that feature about one year ago - it would be fantastic if this came true.

WaMaR · #6 (**permalink**) 04-16-2009, 02:11 PM

I always believed that Masquerade NAT is the same as Source NAT (SNAT), but Masquerading allows for this functionality even though these internal machines don't have an officially assigned IP address.

My ISP provides me the entire class C for public IP addresses and therefore for me it is natural to use additional public addresses for SNAT other servers,

for many local area networks, simple IP authentication, etc.

Therefore, I can not imagine to be limited only to the IP masquerade and one public IP address.

------

I would like to add that much more desirable feature would be adding the possibility of configuration http proxy profiles for use different public IP addresses the same way as is done by doing SNAT for outgoing packets from different local networks.

Read more at: http://www.astaro.org/astaro-gateway-products/general-discussion-feature-requests/25390-feature-requests-configuration-proxy-profiles-use-different-public-source-ip.html