Forward traffic on specific network interface to specific host - iptables

Question

This machine has two interfaces eth0 and eth1. There is a default gateway on eth0:
Destination Gateway Genmask Flags Metric Ref Use Iface
default 10.0.2.1 0.0.0.0 UG 0 0 0 eth0
10.0.2.0 * 255.255.255.0 U 0 0 0 eth0
10.0.2.0 * 255.255.255.0 U 0 0 0 eth1
I need to set up rules with iptables to proxy all incoming traffic on eth1 to 10.0.1.1.
Note that eth0 is associated with a static IP address 10.0.2.2 while eth1 is dynamic.
There is a guide on port forwarding with netfilter that explains how to do this in a slightly simpler setup, but I can't figure out how to go from their example to mine.

Answer 1

Building upon the link you supplied, with the exception of using the conntrack module rather than the state module:
# Activate forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward
# Forward packets coming in from the outside
iptables -t nat -A PREROUTING -p tcp -i eth1 -j DNAT --to-destination 10.0.1.1
# Make responses on the internal network go through the firewall
iptables -t nat -A POSTROUTING -p tcp -d 10.0.1.1 -j SNAT --to-source 10.0.2.2
# Allow forwarded packets
iptables -A FORWARD -p tcp -d 10.0.1.1 -j ACCEPT -m conntrack --ctstate NEW,ESTABLISHED,RELATED
In order to disable reverse path filtering in the kernel, follow the steps described here. I think that in your case, modifying the value of net.ipv4.conf.eth1.rp_filter to 0 via sysctl would suffice.
Note that this workaround is a bit of a security hole. A better approach would be to change the network structure itself.