Keeping it Small and Simple


Very simple NAT set-up on Debian

Filed under: Debian — Tags: , , , , , , , — Lorenzo E. Danielsson @ 14:25

Many people ask me how to set up network address translation (NAT), aka. IP masquerading on a Debian (Etch) box. There are different ways of doing this, but this just works(tm).

You need to know (1) which interface is connected to your ISP, (2) which interface is connected to your LAN and (3) the IP address of your ISPs gateway. Edit /etc/network/if-up.d/iptables (the file probably does not exist), and enter the following:

 1 #! /bin/sh
 3 # Firewall rules.
 4 #
 5 # Assumptions:
 6 #   eth0: connected to ISP
 7 #   eth1: connected to LAN
 8 #   ISP’s gw:
10 # Flush all rules.
11 iptables -F
12 iptables -t nat -F
13 iptables -t mangle -F
15 # Set up NAT.
16 iptables -t nat -A POSTROUTING -o eth0 -j SNAT –to
18 # Enable IP forwarding
19 echo 1 > /proc/sys/net/ipv4/ip_forward
21 # Secure.
22 iptables -A INPUT -m state –state ESTABLISHED,RELATED -j ACCEPT
23 iptables -A INPUT -m state –state NEW -i ! eth0 -j ACCEPT
24 iptables -P INPUT DROP
25 iptables -A FORWARD -i eth0 -o eth0 -j REJECT

You will need to modify to use the correct gateway address (no, that is *not* my ISPs gateway address, I made it up randomly). You may also need to swap eth0 and eth1 unless you have eth0 connected to your ISP.

This script will only set up what is necessary to enable NAT and to provide some rudimentary security. You will want to modify this script to provide other rules as well, to suit your own requirements.

You are done. Your Debian box can now act as a gateway to the Internet for other computers on your LAN, at least once they are configured to use the Debian box as their default gateway.


  1. dont see you using eth1 anywhere?
    is it in this line you forward the internet, if then shouldnt it be
    iptables -A FORWARD -i eth0 -o eth1 -j REJECT?

    Comment by ok — 2008.03.29 @ 10:46

  2. Aha! You spotted something. The comment is lying: there is not eth1. On that box I have eth0 and eth2. Thanks for spotting.

    But, the line you added will not do forwarding..

    Comment by Lorenzo E. Danielsson — 2008.03.29 @ 14:23

RSS feed for comments on this post. TrackBack URI

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

Create a free website or blog at

%d bloggers like this: