Trisul Network Analytics
Developer Zone

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.

====== How to redirect Netflow to Trisul across network segments using NAT ======

In some customers, Trisul is on a separate segment from the production routers. These sites often have a gateway device that be be used to access.  The routers can each the gateway to export NETFLOW but cannot reach the Trisul server. The picture below shows how the setup is.

{{:hardware:netflow-nat.png?600 |}}

This HOWTO explains how to use  Linux IPTABLES NAT to move between the two.

===== IPTABLES Port based NAT =====

On the gateway device you just need to run the following commands, say you want to move port 2055 to a particular IP.

Shutdown ufw or disable firewalld

<code  bash>
# On Ubuntu
ufw disable

# On CentOS/RHEL
systemctl firewalld stop

# Make sure ip forwarding is enabled in kernel
echo 1 > /proc/sys/net/ipv4/ip_forwarding
</code>


Then setup the Port NAT

<code>
$ iptables -t nat -A PREROUTING -p udp --dport 2055 -j DNAT --to-destination 10.10.10.17:2055
$ iptables -t nat -A POSTROUTING -j MASQUERADE
</code>


You should now be seeing Netflow  flowing to the Trisul box.

Trisul Network Analytics Developer Zone

User Tools

Site Tools

Page Tools

Trisul Network Analytics
Developer Zone