add nat in nat

diff --git a/README.md b/README.md
index c6fd072a1ce7d77e3be25f46c15d6ae6e78dfb0f..79f4b899f388e7ff1e1c321beecb1ffb330ed661 100644 (file)
--- a/README.md
+++ b/README.md
@@ -2095,7 +2095,7 @@ sudo apt install libnetfilter-queue-dev
 ```
 ```shell
 
-# gateway to NAT scenario
+# gateway - NAT scenario
 
 # 192.168.122.87 being external ip on ens3
 
@@ -2168,7 +2168,7 @@ sudo iptables -t nat -I POSTROUTING -p udp -o ens3 -j MASQUERADE
 
 ```shell
 
-# NAT to NAT scenario
+# gateway - NAT to NAT scenario
 
 sudo ip netns add net1
 
@@ -2209,6 +2209,71 @@ sudo ip netns exec net1 nc -l 192.168.62.6 9999
 
 sudo ip netns exec net2 nc 192.168.62.6 9999
 
+```
+
+```shell
+
+# gateway - NAT in NAT inline scenario
+
+# resource using the same default gateway
+
+# namespace net1 is virtual gateway (inline, NAT in gateway)
+
+sudo ip netns add net1
+
+sudo ip link add dev veth1 type veth peer name veth2 netns net1
+
+sudo ip link set up veth1
+
+sudo ip netns exec net1 ip link set up veth2
+
+sudo ip addr add 192.168.62.5/24 dev veth1
+
+sudo ip netns exec net1 ip addr add 192.168.62.6/24 dev veth2
+
+sudo ip netns exec net1 ip route add default via 192.168.62.5 dev veth2
+
+sudo ip route add 192.168.64.0/24 via 192.168.62.6 dev veth1
+
+sudo ip netns add net2
+
+sudo ip link add dev veth3 type veth peer name veth4 netns net2
+
+sudo ip link set veth3 netns net1
+
+sudo ip netns exec net1 ip link set up veth3
+
+sudo ip netns exec net2 ip link set up veth4
+
+sudo ip netns exec net1 ip addr add 192.168.122.1/24 dev veth3
+
+sudo ip netns exec net2 ip addr add 192.168.64.6/24 dev veth4
+
+sudo ip netns exec net2 ip route add default via 192.168.64.6 dev veth4
+
+sudo ip netns exec net1 ip route add 192.168.64.0/24 via 192.168.122.1 dev veth3
+
+sudo ip netns exec net1 sysctl -w net.ipv4.ip_forward=1
+
+#tcp
+
+
+sudo ip netns exec net1 iptables -I FORWARD -p tcp --syn -i veth2 -m conntrack --ctstate NEW -j ACCEPT
+
+sudo ip netns exec net1 iptables -I FORWARD -p tcp -i veth2 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+
+sudo ip netns exec net1 iptables -I FORWARD -p tcp --syn -o veth2 -m conntrack --ctstate NEW -j ACCEPT
+
+sudo ip netns exec net1 iptables -I FORWARD -p tcp -o veth2 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+
+sudo ip netns exec net1 iptables -t nat -I POSTROUTING -p tcp -o veth3 -j MASQUERADE
+
+sudo ip netns exec net1 iptables -t nat -I POSTROUTING -p tcp -o veth2 -j MASQUERADE
+
+
+sudo ip netns exec net1 iptables -P FORWARD DROP
+
+
 ```
 
 ```shell

diff --git a/route-nat/inline-construct.sh b/route-nat/inline-construct.sh
new file mode 100755 (executable)
index 0000000..6890619
--- /dev/null
+++ b/route-nat/inline-construct.sh
@@ -0,0 +1,56 @@
+#!/bin/bash
+
+
+sudo ip netns add net1
+
+sudo ip link add dev veth1 type veth peer name veth2 netns net1
+
+sudo ip link set up veth1
+
+sudo ip netns exec net1 ip link set up veth2
+
+sudo ip addr add 192.168.62.5/24 dev veth1
+
+sudo ip netns exec net1 ip addr add 192.168.62.6/24 dev veth2
+
+sudo ip netns exec net1 ip route add default via 192.168.62.5 dev veth2
+
+sudo ip route add 192.168.64.0/24 via 192.168.62.6 dev veth1
+
+sudo ip netns add net2
+
+sudo ip link add dev veth3 type veth peer name veth4 netns net2
+
+sudo ip link set veth3 netns net1
+
+sudo ip netns exec net1 ip link set up veth3
+
+sudo ip netns exec net2 ip link set up veth4
+
+sudo ip netns exec net1 ip addr add 192.168.122.1/24 dev veth3
+
+sudo ip netns exec net2 ip addr add 192.168.64.6/24 dev veth4
+
+sudo ip netns exec net2 ip route add default via 192.168.64.6 dev veth4
+
+sudo ip netns exec net1 ip route add 192.168.64.0/24 via 192.168.122.1 dev veth3
+
+sudo ip netns exec net1 sysctl -w net.ipv4.ip_forward=1
+
+#tcp
+
+
+sudo ip netns exec net1 iptables -I FORWARD -p tcp --syn -i veth2 -m conntrack --ctstate NEW -j ACCEPT
+
+sudo ip netns exec net1 iptables -I FORWARD -p tcp -i veth2 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+
+sudo ip netns exec net1 iptables -I FORWARD -p tcp --syn -o veth2 -m conntrack --ctstate NEW -j ACCEPT
+
+sudo ip netns exec net1 iptables -I FORWARD -p tcp -o veth2 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+
+sudo ip netns exec net1 iptables -t nat -I POSTROUTING -p tcp -o veth3 -j MASQUERADE
+
+sudo ip netns exec net1 iptables -t nat -I POSTROUTING -p tcp -o veth2 -j MASQUERADE
+
+
+sudo ip netns exec net1 iptables -P FORWARD DROP

diff --git a/route-nat/inline-destroy.sh b/route-nat/inline-destroy.sh
new file mode 100755 (executable)
index 0000000..4368cf6
--- /dev/null
+++ b/route-nat/inline-destroy.sh
@@ -0,0 +1,12 @@
+#!/bin/bash
+
+
+# delete rules 
+
+sudo iptables -F 
+
+sudo iptables -t nat -F
+
+sudo ip netns del net2
+
+sudo ip netns del net1
\ No newline at end of file