| View previous topic :: View next topic |
| Author |
Message |
ignarus
n00b
Joined: 09 Apr 2003
Posts: 49
Location: Leuven, Belgium
|
 Posted: Wed Apr 09, 2003 1:11 pm Post subject: how do I set up ip masquerading? |
 |
|
Hi
I'm trying to set up a router on my gentoo box. I have two NICs: eth0 for the external ip (dhcp address from isp) and eth1 pointing to the internal network with ip 10.0.0.1.
I tried to test basic routing by executing "iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE"
When I tried to connect with a client pc (running win2k) to the internet, it didn't work. The client is set up to use the router as it's gateway.
Is there something else I need to do to get ip masquerading working?
Do I need to add an extra route or something?
My routing table looks like this:
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
10-67-88-0.kotn * 255.255.248.0 U 0 0 0 eth0
10.0.0.0 * 255.0.0.0 U 0 0 0 eth1
default 10-67-95-254.ko 0.0.0.0 UG 0 0 0 eth0
Thnx |
|
| Back to top |
|
 |
nephros
Advocate
Joined: 07 Feb 2003
Posts: 2139
Location: Graz, Austria (Europe - no kangaroos.)
|
| Posted: Wed Apr 09, 2003 1:29 pm Post subject: |
|
|
this is what I use.
very simple, but it works:
| Code: |
# define internal and external NIC
INTIF=eth0
EXTIF=eth1
# services accessible from outside; only ssh for me.
TCP_SERVICES="22"
# log connection attempts to these ports:
LOG_PORTS="21,23,25,123,12345,12346"
# make sure the firewall can handle ftp connects
modprobe ip_nat_ftp
modprobe ip_conntrack_ftp
# Kernel guard against SYN flooding
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
# enable ip forwarding
echo "1" > /proc/sys/net/ipv4/ip_forward
# create the tables
iptables -F INPUT
iptables -F FORWARD
iptables -F OUTPUT
iptables -t nat -F POSTROUTING
iptables -P INPUT DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i $EXTIF -m state --state NEW -p tcp -m multiport --dport $TCP_SERVICES -j ACCEPT
iptables -A INPUT -i $EXTIF -p icmp -j ACCEPT
iptables -A INPUT -i $INTIF -m state --state NEW -j ACCEPT
iptables -A INPUT -i lo -m state --state NEW -j ACCEPT
iptables -A INPUT -j LOG -m multiport -p tcp --dports $LOG_PORTS --log-prefix "FW_INPUT "
iptables -P FORWARD DROP
iptables -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT
iptables -A FORWARD -i $EXTIF -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -j LOG --log-prefix "FW_FORWARD "
iptables -P OUTPUT ACCEPT
iptables -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE
|
this is the script to disable the firewall completely, but do masquerading anyway:
| Code: |
INTIF=eth0
EXTIF=eth1
iptables -F INPUT
iptables -F FORWARD
iptables -F OUTPUT
iptables -t nat -F POSTROUTING
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
iptables -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE
|
_________________
Please put [SOLVED] in your topic if you are a moron. |
|
| Back to top |
|
|
Qubax
Guru
Joined: 19 Jul 2002
Posts: 451
Location: Tirol, Austria
|
| Posted: Thu Apr 10, 2003 6:46 am Post subject: |
|
|
from my brother i know, that you also have set a nameserver ip somewhere (i think i should be found somewhere near the gateway)
for forwarding an firewall you may havbe a look at http://projectfiles.com/firewall |
|
| Back to top |
|
|
ignarus
n00b
Joined: 09 Apr 2003
Posts: 49
Location: Leuven, Belgium
|
| Posted: Thu Apr 10, 2003 11:47 am Post subject: got it working |
|
|
Hi
thanks for the help,
I've got it working now.  |
|
| Back to top |
|
|
Kulfaangaren!
Apprentice
Joined: 11 Jan 2003
Posts: 176
Location: Borås, Sweden
|
| Posted: Thu Apr 10, 2003 12:54 pm Post subject: Hmmm.. |
|
|
You guys all use the MASQUERADE target....aren't we supposed to use the SNAT target these days ?
| Code: | | /usr/sbin/iptables -t nat -A POSTROUTING -o $INET_IFACE -j SNAT --to-source $INET_IP |
// Fredrik |
|
| Back to top |
|
|
cato`
Guru
Joined: 03 Jun 2002
Posts: 430
Location: Norway, Trondheim
|
| Posted: Thu Apr 10, 2003 12:57 pm Post subject: Re: Hmmm.. |
|
|
| Kulfaangaren! wrote: | You guys all use the MASQUERADE target....aren't we supposed to use the SNAT target these days ?
| Code: | | /usr/sbin/iptables -t nat -A POSTROUTING -o $INET_IFACE -j SNAT --to-source $INET_IP |
// Fredrik |
I think you should use SNAT with static IP's and MASQ with dynamic.... |
|
| Back to top |
|
|
Kulfaangaren!
Apprentice
Joined: 11 Jan 2003
Posts: 176
Location: Borås, Sweden
|
| Posted: Thu Apr 10, 2003 1:47 pm Post subject: |
|
|
Ahhh ok, didn't think about that....just because I have a static IP not everyone does 
Thanks for pointing that out.
// Fredrik |
|
| Back to top |
|
|
|
Networking & Security
