Ttyjfyk

I'm trying to forward ports with iptables NAT rules, but it doesn't seem to work.

So I want traffic from NAT#1 in a specific port range go to a specific server in a server group and traffic from NAT#2 to another server group.

I have to use the "NAT server" 192.168.1.10 as SNAT otherwise the FW will drop the traffic.

I've tried the following on the "NAT server",

Example A - NAT#1 port 4000 to Server Group A

sudo iptables -t nat -A PREROUTING -p tcp -d 192.168.1.20 --dport 4000 -j DNAT --to-destination 192.168.1.100
sudo iptables -t nat -A POSTROUTING -s 192.168.1.100 -j SNAT --to 192.168.1.10

Example B - NAT#2 port 5000 to Server Group B

sudo iptables -t nat -A PREROUTING -p tcp -d 192.168.1.30 --dport 5000 -j DNAT --to-destination 192.168.1.201
sudo iptables -t nat -A POSTROUTING -s 192.168.1.201 -j SNAT --to 192.168.1.10

UPDATE

I have to use the "NAT server" 192.168.1.10 as SNAT otherwise the
FW will drop the traffic.

This works, kind of.

sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family=ipv4 destination address=192.168.1.20 forward-port port=4000-4010 protocol=tcp to-addr=192.168.1.100'
sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family=ipv4 destination address=192.168.1.30 forward-port port=4000-4010 protocol=tcp to-addr=192.168.1.200'
sudo firewall-cmd --reload

but not with one zone. As they write in RedHat firewall doc,

A rule is associated with a particular zone. A zone can have several rules. If some rules interact or contradict, the first rule that matches the packet applies.

So I have to use two zones. Is this possible with two aliases?!?

UPDATE

This worked...

firewall-cmd --permanent --direct --add-rule ipv4 nat PREROUTING 0 -p tcp -m tcp -d "nat_alias" --dport "ext_port" -j DNAT --to-destination "server_ip":"int_port"
firewall-cmd --permanent --direct --add-rule ipv4 filter FORWARD 0 -m state -p tcp -d "server_ip" --dport "int_port" --state NEW,ESTABLISHED,RELATED -j ACCEPT
firewall-cmd --permanent --direct --add-rule ipv4 nat POSTROUTING 0 -t nat -p tcp -m tcp -s "server_ip" --sport "int_port" -j SNAT --to-source "nat_ip"

You should do NAT/SNAT first after that you use NAT/SNAT ip address to forward port.Maybe you need to separate iptable rules.