One-to-one NAT

From DD-WRT Wiki

Revision as of 19:47, 10 April 2009 by Stidem (Talk | contribs)
Jump to: navigation, search

One-to-one NAT (aka Static NAT) is a way to make systems behind a firewall and configured with private IP addresses (those addresses reserved for private use in RFC 1918) appear to have public IP addresses.¹

I'm using this type of setup, with three public IPs. WRT54GL v.1.1 with DD-WRT RC6 and it works just fine.²

I have done following:




Set up new public static IP on dd-wrt WAN interface vlan1. This must be done for each public static IP and should be save to the Startup script using the Save Statup button.

ifconfig vlan1:1 PUBLIC_IP1 netmask NETMASK broadcast BROADCAST
ifconfig vlan1:2 PUBLIC_IP2 netmask NETMASK broadcast BROADCAST


ifconfig vlan1:1 netmask broadcast
ifconfig vlan1:2 netmask broadcast



route all packets for the new public ip, to a certain local ip

iptables -t nat -I PREROUTING -i vlan1 -d PUBLIC_IP -j DNAT --to-destination LAN_IP

masquerade returned packets from the local ip to the public ip

iptables -t nat -I POSTROUTING -o vlan1 -s LAN_IP -j SNAT --to-source PUBLIC_IP

translate anything else from the lan to the "main" router ip

iptables -t nat -I POSTROUTING -o vlan1 -s LAN_SUBNET (ex. -j SNAT --to-source MAIN_IP

Forward port X to above local IP

iptables -I FORWARD -p tcp -i vlan1 -d LAN_IP --dport X -j ACCEPT


iptables -I FORWARD -p tcp -d --dport 21 -j ACCEPT
iptables -I FORWARD -p tcp -d --dport 80 -j ACCEPT
iptables -I FORWARD -p tcp -d --dport 5900 -j ACCEPT

You could also replace above rule(s) with the following:

iptables -I FORWARD -p all -i vlan1 -d LAN_IP -j ACCEPT 

Which instead of forwarding just a single port, will let through all tcp/udp connections on all ports to this public ip-->lan ip.

In other words forwarding all connections would be no firewalling what so ever.