I spent quite a long time googling for a way of re-creating symmetric cone nat in house without buying Cisco hardware. Hopefully someone else will find this useful. This was done on Ubuntu 8.04 beta.


eth1 = public ip
eth0 = lan ip


echo "1" > /proc/sys/net/ipv4/ip_forward
/sbin/iptables --flush
/sbin/iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE --random
/sbin/iptables -A FORWARD -i eth1 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
/sbin/iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT