Keeping it Small and Simple

2008.03.16

Very simple NAT set-up on Debian

Filed under: Debian — Tags: , , , , , , , — Lorenzo E. Danielsson @ 14:25

Many people ask me how to set up network address translation (NAT), aka. IP masquerading on a Debian (Etch) box. There are different ways of doing this, but this just works(tm).

You need to know (1) which interface is connected to your ISP, (2) which interface is connected to your LAN and (3) the IP address of your ISPs gateway. Edit /etc/network/if-up.d/iptables (the file probably does not exist), and enter the following:


 1 #! /bin/sh
 2
 3 # Firewall rules.
 4 #
 5 # Assumptions:
 6 #   eth0: connected to ISP
 7 #   eth1: connected to LAN
 8 #   ISP's gw: 44.219.1.114
 9
10 # Flush all rules.
11 iptables -F
12 iptables -t nat -F
13 iptables -t mangle -F
14
15 # Set up NAT.
16 iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to 44.219.1.114
17
18 # Enable IP forwarding
19 echo 1 > /proc/sys/net/ipv4/ip_forward
20
21 # Secure.
22 iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
23 iptables -A INPUT -m state --state NEW -i ! eth0 -j ACCEPT
24 iptables -P INPUT DROP
25 iptables -A FORWARD -i eth0 -o eth0 -j REJECT

You will need to modify to use the correct gateway address (no, that is *not* my ISPs gateway address, I made it up randomly). You may also need to swap eth0 and eth1 unless you have eth0 connected to your ISP.

This script will only set up what is necessary to enable NAT and to provide some rudimentary security. You will want to modify this script to provide other rules as well, to suit your own requirements.

You are done. Your Debian box can now act as a gateway to the Internet for other computers on your LAN, at least once they are configured to use the Debian box as their default gateway.

About these ads

2 Comments »

  1. dont see you using eth1 anywhere?
    is it in this line you forward the internet, if then shouldnt it be
    iptables -A FORWARD -i eth0 -o eth1 -j REJECT?

    Comment by ok — 2008.03.29 @ 10:46

  2. Aha! You spotted something. The comment is lying: there is not eth1. On that box I have eth0 and eth2. Thanks for spotting.

    But, the line you added will not do forwarding..

    Comment by Lorenzo E. Danielsson — 2008.03.29 @ 14:23


RSS feed for comments on this post. TrackBack URI

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

The Silver is the New Black Theme. Create a free website or blog at WordPress.com.

Follow

Get every new post delivered to your Inbox.

Join 26 other followers

%d bloggers like this: