Nat

Hi.

I wish to create a nat with masquerading to allow my LAN to access to Internet.
I have two LANs: 192.168.1.x and 192.168.2.x. The server wich will make the masquerading has both two LANs with two ethernet card. How I can allow only one LAN to access Internet with ppp0 on the server?
I tried these lines, but it doesn't work:

iptables -t nat -F POSTROUTING
iptables -t nat -A POSTROUTING -j DROP
iptables -t nat -A POSTROUTING -s 192.168.1.0/255.255.255.0 -o ppp0 -j MASQUERADE

What I can do?

Thank you very much
Bye
Mattia Martinello

Never, never set a default policy other than ACCEPT on the nat or mangle tables !

That should work fine. A pity you can't use the -i option to specify the
input interface in the POSTROUTING chain, but there you go....

You could alternatively filter out packets from 192.168.2.0/24 going to ppp0, and then just MASQUERADE everything exiting ppp0 ?

Antony.

It is also possible that putting the birds in a laboratory setting
inadvertently renders them relatively incompetent.

 - Daniel C Dennett

Try :

iptables -P INPUT DROP
iptables -A INPUT -s 192.168.1.0/24 -j ACCEPT

iptables -P FORWARD DROP
iptables -A FORWARD -s 192.168.1.0/24 -o ppp0 -j ACCEPT iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o ppp0 -j MASQUERADE

Rob

This drops every packet, leaving the box. This is not what you want.

First masquerade the packets:

$ iptables -t nat -A POSTROUTING -s 192.168.1.0/255.255.255.0 -o ppp0 \
	-j MASQUERADE

Now only allow packets from the network that is to have internet access to pass through the firewall. All these packets go through the FORWARD chain in the FILTER tables. This is where you want to filter who should have internet access or not.

$ iptables -P FORWARD DROP
$ iptables -A FORWARD -s 192.168.1.0/255.255.255.0 -o ppp0 -j ACCEPT

Now allow only packets related to a connection from the lan to pass through the firewall from the internet.

$iptables -A FORWARD -i ppp0 -m state --state RELATED,ESTABLISHED \
-j ACCEPT

And lastly close up the firewall, but allow the firewall itself to receive replys:

$iptables -P INPUT DROP
$iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

And allow clients from the lan's to ssh to the firewall.

$ iptables -A INPUT -i eth+ -p tcp --dport ssh -j ACCEPT

Thats it. If you want the two lans to be able to talk to eachother then add:

$ iptables -A FORWARD -i eth+ -o eth+ -j ACCPET

Hope it helps.
If not, then read and unserstand (thats the importent part) the howtos and tutorials for iptables.

Regards
Anders Fugmann

--
Author of FIAIF
FIAIF Is An Intelligent Firewall
http://fiaif.fugmann.dhs.org