# {{ansible_managed}} -- {{type}} test

# [UPDATE] tcp      6 432000 ESTABLISHED src=10.1.1.2 dst=10.1.1.3 sport=33816 dport=22 src=10.1.1.3 dst=10.1.1.2 sport=22 dport=33816 [ASSURED]

flush ruleset

table ip nat {
        # DNAT
        chain prerouting {
                type nat hook prerouting priority mangle;

		# translate inbound destination address (stateless)
		iif eth0 tcp dport 22 ip daddr set 10.1.1.1

		# translate outbound destination address (stateless)
		# ANOMALY HERE just for testing - we are not supposed to know
		# the originating source
		iif eth1 ip daddr set 192.168.122.1
        }

	# SNAT
        chain postrouting {
	        type filter hook postrouting priority mangle;

		# translate outbound source address (stateless)
                oif eth0 ip saddr set 192.168.122.102

		# translate inbound source address (stateless)
                oif eth1 ip saddr set 10.1.1.2
        }
}