MAC snat by source IP address

Hi.

I have a machine running a transparent proxy using the standard IPtables
redirect and ebtables BROUTING method:

iptables -t nat -A PREROUTING -i br0 -p tcp --dport <PORT ON SERVER> --dst <IP OF SERVER> -j
REDIRECT --to-port <local proxy port>
/sbin/ebtables -t broute -A BROUTING -i br0 -p IPv4 --ip-protocol 6 --ip-destination-port
xyz--ip-dst <IP OF SERVER> -j redirect --redirect-target ACCEPT

I need to make the servers the proxy connects to completely transparent to the client.
I therefore used this line:

ebtables -t nat -A POSTROUTING -o ethx -j snat --to-source <MAC OF SERVER>

This works fine and makes all replies from SERVER come back with the
real MAC of the SERVER.

Now I want to have more than one SERVER. My first thought was this:

ebtables -t nat -A POSTROUTING -p IPv4 --ip-protocol 6 --ip-source <IP OF SERVER> -o ethx -j snat
--to-source <MAC of SERVER>

Unfortunately this doesn't work because ebtables thinks the source IP of
the replies is the IP address of the bridge.

Any ideas on how I can match the real IP address of the SERVERS?

Many thanks,


Pete.
-- 
Pete Philips
Secerno Ltd
Email: [email protected]
PGP key: http://www.secerno.com/pgp/pete.gpg

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/