computers:firewall_configuration
Differences
This shows you the differences between two versions of the page.
Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
computers:firewall_configuration [2011/08/30 22:52] – [iptables masquerading] chkuo | computers:firewall_configuration [2020/08/16 00:13] (current) – [References] chkuo | ||
---|---|---|---|
Line 1: | Line 1: | ||
====== Firewall configuration ====== | ====== Firewall configuration ====== | ||
- | ===== iptables masquerading | + | ===== Source NAT ===== |
First enable IPv4 packet forwarding by editing ''/ | First enable IPv4 packet forwarding by editing ''/ | ||
<code bash> | <code bash> | ||
net.ipv4.ip_forward=1 | net.ipv4.ip_forward=1 | ||
</ | </ | ||
+ | Apply by '' | ||
Then add the following lines to ''/ | Then add the following lines to ''/ | ||
<code bash> | <code bash> | ||
- | # enable masquerading | + | # source NAT |
+ | # alter the source address of the packets from the internal network | ||
Ext_IF=" | Ext_IF=" | ||
- | Int_IF=" | + | Ext_IP=" |
- | iptables -t nat -A POSTROUTING -s 192.168.1.0/ | + | Int_IF=" |
- | iptables -A FORWARD -s 192.168.1.0/ | + | Int_Net=" |
- | iptables -A FORWARD -d 192.168.1.0/ | + | iptables -t nat -A POSTROUTING -s $Int_Net |
+ | iptables -A FORWARD -s $Int_Net | ||
+ | iptables -A FORWARD -d $Int_Net -i $Int_IF | ||
</ | </ | ||
- | ===== Forwarding | + | ===== Destination NAT ===== |
<code bash> | <code bash> | ||
- | # forward ssh to workstation with the internal ip 192.168.1.2 | + | # destination NAT |
+ | # forward ssh to Int_IP if the external IP Ext_IP_2 was used | ||
+ | Ext_IP_2=" | ||
Int_IP=" | Int_IP=" | ||
- | iptables -t nat -I PREROUTING -p tcp -i $Ext_IF | + | iptables -t nat -I PREROUTING -p tcp -d $Ext_IP_2 |
iptables -A FORWARD -i $Ext_IF -o $Int_IF -p tcp --dport 22 -j ACCEPT | iptables -A FORWARD -i $Ext_IF -o $Int_IF -p tcp --dport 22 -j ACCEPT | ||
</ | </ | ||
+ | |||
+ | |||
+ | |||
+ | ===== Monitoring ===== | ||
+ | <code bash> | ||
+ | sudo iptables -t nat -L | ||
+ | </ | ||
+ | |||
+ | |||
+ | |||
===== References ===== | ===== References ===== | ||
* [[https:// | * [[https:// | ||
+ | * [[https:// |
computers/firewall_configuration.1314715939.txt.gz · Last modified: 2011/08/30 22:52 by chkuo