0

I have a linux machine running ubuntu server with 2NICS (WAN and LAN). I want the LAN side machines to use the linux box as a gateway to get on the internet (WAN side). The only problem is that the LAN side machines will have static IP's and cannot be configured for DHCP. I have to work arround the settings they have. I have written a small program which runs on the server, listens to ARP requests and gets all client trafic and NATs them to the WAN side. The clients now can ping google irrespective of their static IP addresses.

My code does NAT, based on MAC addresses i.e. A client's packets from XX:YY will be sent out using 10.0.0.1. as source address. Another client with ZZ:ZZ will have packets with source address 10.0.0.2 on the WAN side interface. The purpose of all of this is to have sort of a zero config internet access for captive portal users.

My problem is that i am having trouble getting TCP/HTTP to work through my NAT. The GET request does not get a reply from the WAN side so i am stuck and thinking of alternatives!

Question time: 1. Can this be done using netfilter and IP tables? instead of writhing my own NAT code. 2. Are there any open source user space NAT programs that i could take and modify? 3. Can i modify the current netfilter code? will this be a huge task?

My tools: libpcap, gcc, wireshark, ubuntu server 10.10

I am new to linux network programming, any sujesions would be appreciated.

Thanks,

Mal

0

1 Answer 1

4

I don't see why using a static addressing would be a problem. Netfilter do native NAT and is easy to build with iptables.

If "eth0" represents your LAN-side interface on the server, and eth1 the WAN-side, running "iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE" (the minimum required for a NAT) should do it.

Although you'll maybe need to check the default policies, especially for the FORWARD chain (iptables -P FORWARD ACCEPT/DROP).

1
  • And now in recent versions of ufw(8) you can also set up forwarding and filter that. So no need for hacking low level iptables(8) stuff any more, which is great.
    – Anders
    Feb 18, 2019 at 12:58

You must log in to answer this question.