Setting up NAT using IPTABLES

[ChrisH]

Im trying to set up nat on one of my Linux boxes. I have read a few guides and have even remembered the free oreilly book I got free once with something "Linux iptables Pocket Reference" .

 

I want to start simple with just setting nat up for now and locking the ports down more later.

From what ive seen I need to use a SNAT rule and enable forwarding. This needs to be run as a script on startup from /etc/init.d

Given that eth0 is public and eth1 is private:

 

The script will contain the following:

Delete all current rules:

/sbin/iptables -F
/sbin/iptables -t nat -F
/sbin/iptables -t mangle -F #ignore if you get an error here
/sbin/iptables -X #deletes every non-builtin chain in the table

 

Rules to allow all connections out and existing and related ones in:

 

/sbin/iptables -A FORWARD -i eth0 -o eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT

 

The actual NAT rule where 10.0.0.1 is the address of eth0

/sbin/iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to 10.0.0.1

 

Then enable packet forwarding by kernel

echo 1 > /proc/sys/net/ipv4/ip_forward 

 

Does this look right? I seem to be reading confilcting stuff so just want to make sure.

[Geoff]

yes, that looks correct. However rather than writing your iptables rules directly you might find using a set of premade scripts like Shorewall is less likely to lead to serious brain ache.

 

http://www.shorewall.net/

[ChrisH]

Aye I have looked at other pre made stuff but just wanted to do a bit manually so I could understand it better.

[Geoff]

Fair enough. Be careful though if your playing with a live system. You can do serious damage to your networks routing and security.

 

I use shorewall on all my systems these days. I'm lazy and it works. Plus I don't have to audit it for security because its done for me by the shorewall community.

[ChrisH]

Well as long as I know that code would work I I understand most of it so.... Times a ticking so I will got with the shorewall

[Geoff]

You can always look at the rulechains shorewall produces from your configuration. thats usually fairly educational.

[ChrisH]

Oh btw I set your quakenet account to +ao in the #edugeek channel. I will get the ident stuff sorted tonight then apply for a trusted IP.

[Geoff]

Fair enough. If you have trouble with the trust give me a shout. I know a few IRCOps that owe me favors. Also, I have an eggdrop floating around. So if you want a bot to police the channel against usual lameness (floods, spam, control avalanches) then I can bring him in too.

[ChrisH]

Been playing with shorewall for a bit and have got the hang of it just about. I have downloaded the two-interface example and Im using that. Only problem is it ignores everything in the policy file and I have to make all changes in the rules file :? . I havent even touched it really aprt from uncomment the bit about giving users access to all port internally.

[Geoff]

did you define your interfaces?

[ChrisH]

The interfaces look ok in the predefined set that came with the example I downloaded so I havent altered it.

[Geoff]

So you've correctly associated the right interface with the right zone?

[ChrisH]

Yes just checked the zones file and the interface file seem to be set as they should be. I assume it always knows fw is the local machine and that it doesnt need setting anywhere?

[Geoff]

Does your external interface use a public internet IP or are you natted out somehow by your provider? Is your internal network using an RFC1918 compatible network range?

[ChrisH]

Network 192.168.0.0/23---------- 192.168.0.0/23 Firewall 10.x.x.x --> Cleo Router.

 

Is my current setup.

[Geoff]

alrighty then. that explains it. Your using the wrong set of configuration files. You need the bridge configuration.

 

http://www.shorewall.net/bridge.html

[ChrisH]

Ah that will be why :oops: I think the terminology my old censornet install threw me off though as the bridge configuration just uses one interface. I shall check it out cheers.

[ChrisH]

The example on that page indicates that the router and the main network are on the same subnet. Is that just a bad example? All my computers and servers are on a 192.168.0.0/23 range and the CLEO router is on the 10.x.x.x range. At the moment my Censornet box routes between the two.

[Geoff]

no thats how a bridge works. Why aren't you using your assigned IP range on your network?

[ChrisH]

It allows me more flexibility on the IP address assignment and allows me to vlan the connection to the router so the only way to the router is through my proxy.

So given that I still need a bridge with 2 IP Ranges?

 

Ps transparent proxy wasnt an option when I set it all up.

[Geoff]

You can transparent proxy with a bridge (even on the same box if you like). The bridge can deny direct access to the router (or anything else the other side of the bridge) on a per ip/mac/port basis. VLANing the connection is a waste of a perfectly good vlan.

[ChrisH]

I wont be changing the addressing scheme as it would be a big task and I like it how it is.

So from what Im seeing here its not a bridge I need? as I have 2 seperate ranges? I know for a fact my censornet box is acting like a router.

Right Im going to go and do something else before my head explodes .

 

Edit Ok just found a network diagram with 2 IP ranges which has settled me a bit. The one on the public side is used for administration and isnt really used.

/Me heads off to Wikipedia....

[Geoff]

yes. you need to go back to the 2 interface example. Because both your IP ranges are rfc1918 compliant though you should remove the 'norfc1918' option from the external interface's entry in /etc/shorewall/interfaces.

[ChrisH]

Ok thank you I can feel the pressure in my head beginning to settle