Linux: address the same IP range (different networks) via two interfaces masqueraded [closed]

Question

Not sure whether it can be done: Due to a legacy setup there are two separate networks that both use the same class C subnet 192.168.0.0/24. I have a Linux box with two physical interfaces wherein each has a (different) IP in that subnet.

What I'd like to do is to add NAT or masquerading in a way that allows me to access the network behind the second interface as if it had another IP subnet. I.e. any request to 10.0.1.100 is supposed to go out to interface eth2 and a request to 192.168.1.100 should go out via eth1. The source IP should appear as if it was in the 192/24 subnet ideally. I.e. any rewriting should happen on the local box only.

The routing table is already set up accordingly: Traffic to 10/8 is set up to go via dev eth2 using the local IP from the 192/24 subnet and traffic to the 192/24 subnet is routed to eth1.

Trying to add DNAT to rewrite the destination address did not work however because that happens in the prerouting step and rewriting will redirect any traffic to the first interface which has the route for the 192/24 subnet.

Maybe masquerading could work but after reading up on the structure of the network layer I'm not sure whether it can or should be done at all.

It's a zany setup and setting up a separate box to do some NATing might be easier but I feel like there's some interesting things to learn here so it would be great to hear from someone more experienced on the topic 😅

Answer 1

This is a job for VRF -- aka netns. While most host-centric operating systems will allow multiple interfaces to be in the same numeric subnet, when they aren't actually the same network, the behavior is somewhat unpredictable. Real Routers™ won't allow you to do that, so one has to put the different interfaces in different domains. On linux, that's done through the network namespace subsystem ("netns")

Once the two 192.168.0.0/24's are isolated, it should be possible to NAT between them.