Kuo Lab Wiki

User Tools

Site Tools

You are here: start » computers » firewall_configuration
computers:firewall_configuration

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
computers:firewall_configuration [2011/08/30 22:49] – chkuocomputers:firewall_configuration [2020/08/16 00:13] (current) – [References] chkuo
Line 1: Line 1:
 ====== Firewall configuration ====== ====== Firewall configuration ======
-===== iptables masquerading =====+===== Source NAT =====
 First enable IPv4 packet forwarding by editing ''/etc/sysctl.conf'', uncomment (or add) the following line: First enable IPv4 packet forwarding by editing ''/etc/sysctl.conf'', uncomment (or add) the following line:
 <code bash> <code bash>
 net.ipv4.ip_forward=1 net.ipv4.ip_forward=1
 </code> </code>
 +Apply by ''sudo sysctl -p''
  
 Then add the following lines to ''/etc/rc.local'' (so the rule is enabled on reboot): Then add the following lines to ''/etc/rc.local'' (so the rule is enabled on reboot):
 <code bash> <code bash>
-Ext_IF='eth0' +# source NAT 
-Int_IF='eth3' +# alter the source address of the packets from the internal network 
-iptables -t nat -A POSTROUTING -s 192.168.1.0/16 -o $Ext_IF -j MASQUERADE +Ext_IF="eth0" 
-iptables -A FORWARD -s 192.168.1.0/16 -o $Ext_IF -j ACCEPT +Ext_IP="1.1.1.1" 
-iptables -A FORWARD -d 192.168.1.0/16 -m state --state ESTABLISHED,RELATED -i $Int_IF -j ACCEPT+Int_IF="eth1" 
 +Int_Net="192.168.1.0/24" 
 +iptables -t nat -A POSTROUTING -s $Int_Net -o $Ext_IF -j SNAT --to-source $Ext_IP 
 +iptables -A FORWARD -s $Int_Net -o $Ext_IF -j ACCEPT 
 +iptables -A FORWARD -d $Int_Net -i $Int_IF -m state --state ESTABLISHED,RELATED -j ACCEPT
 </code> </code>
  
-===== Forwarding =====+===== Destination NAT =====
 <code bash> <code bash>
-# forward ssh to workstation with the internal ip 192.168.1.2 +# destination NAT 
-Int_IP='192.168.1.2' +# forward ssh to Int_IP if the external IP Ext_IP_2 was used  
-iptables -t nat -I PREROUTING -p tcp -i $Ext_IF --dport 22 -j DNAT --to-destination $Int_IP:22+Ext_IP_2="1.1.1.2" 
 +Int_IP="192.168.1.2" 
 +iptables -t nat -I PREROUTING -p tcp -d $Ext_IP_2 --dport 22 -j DNAT --to-destination $Int_IP:22
 iptables -A FORWARD -i $Ext_IF -o $Int_IF -p tcp --dport 22 -j ACCEPT iptables -A FORWARD -i $Ext_IF -o $Int_IF -p tcp --dport 22 -j ACCEPT
 </code> </code>
 +
 +
 +
 +===== Monitoring =====
 +<code bash>
 +sudo iptables -t nat -L
 +</code>
 +
 +
 +
 ===== References ===== ===== References =====
   * [[https://help.ubuntu.com/10.04/serverguide/C/firewall.html]]   * [[https://help.ubuntu.com/10.04/serverguide/C/firewall.html]]
 +  * [[https://www.networkreverse.com/2020/06/how-to-build-linux-router-with-ubuntu.html]]
computers/firewall_configuration.1314715796.txt.gz · Last modified: 2011/08/30 22:49 by chkuo