Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My system is behind a Linux firewall, where eth0 is connected to internet and eth1 is connected to my LAN. The issue is I am not able to ping to outside my network. The iptables rule I have used here as below.

iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -p icmp -j SNAT --to-source $PUBLICIP

Please correct me if I am doing anything wrong here.

Packet forwarding is enabled by the kernel.

The script containing iptables rules are as follows.

IPT=/sbin/iptables

echo 0 > /proc/sys/net/ipv4/tcp_ecn
echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter
echo 1 > /proc/sys/net/ipv4/conf/all/proxy_arp
echo 1 > /proc/sys/net/ipv4/ip_forward


# Removing Ipchains modules and inserting IPT modules
/sbin/rmmod ipchains &> /dev/null
/sbin/modprobe ip_tables
/sbin/modprobe ip_nat_ftp
/sbin/modprobe ip_nat_irc


# Connection tracking module
/sbin/modprobe ip_conntrack &> /dev/null
/sbin/modprobe ip_conntrack_ftp &> /dev/null
/sbin/modprobe ip_conntrack_irc


# Flush Default Rules
/sbin/iptables -F
/sbin/iptables -t nat -F
/sbin/iptables -t mangle -F
/sbin/iptables -F INPUT
/sbin/iptables -F FORWARD
/sbin/iptables -F OUTPUT
/sbin/iptables -t nat -F POSTROUTING
/sbin/iptables -t nat -F PREROUTING
/sbin/iptables -t nat -F OUTPUT
/sbin/iptables -t mangle -F PREROUTING
/sbin/iptables -t mangle -F OUTPUT

# Setting Default policies on rules
/sbin/iptables -P INPUT ACCEPT
/sbin/iptables -P FORWARD ACCEPT
/sbin/iptables -P INPUT DROP
/sbin/iptables -P FORWARD DROP

/sbin/iptables -t nat -P POSTROUTING ACCEPT
/sbin/iptables -t nat -P PREROUTING ACCEPT
/sbin/iptables -t nat -P OUTPUT ACCEPT
/sbin/iptables -t mangle -P PREROUTING ACCEPT
/sbin/iptables -t mangle -P OUTPUT ACCEPT

LANIF="lo eth1 ppp0"

for x in ${LANIF}
do
$IPT -A INPUT -i ${x} -j ACCEPT
$IPT -A FORWARD  -i ${x} -j ACCEPT
done



#Google DNS
/sbin/iptables -t nat -A POSTROUTING -d 8.8.8.8 -o eth0 -j SNAT --to-source $PUBLICIP
/sbin/iptables -t nat -A POSTROUTING -d 8.8.4.4 -o eth0 -j SNAT --to-source $PUBLICIP


/sbin/iptables -t nat -A POSTROUTING -s 192.168.1.76  -o eth0 -j SNAT --to-source $PUBLICIP    
/sbin/iptables -t nat -A POSTROUTING -s 192.168.1.3  -o eth0 -j SNAT --to-source $PUBLICIP     
/sbin/iptables -t nat -A POSTROUTING -s 192.168.1.68  -o eth0 -j SNAT --to-source $PUBLICIP    



/sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED \
-j ACCEPT
/sbin/iptables -A FORWARD -m state --state ESTABLISHED,RELATED \
-j ACCEPT

# List The Rules
echo "###########  FILTER  ############################"
/sbin/iptables -L -n -v
echo ""
echo "###########    NAT   ############################"
/sbin/iptables -t nat -L -n -v
echo ""
echo "###########  MANGLE  ############################"
/sbin/iptables -t mangle -L -n -v
echo ""
echo "#################################################"
share|improve this question
2  
Ok, you NATed the icmp, but did you actually put in any rules in the FORWARD chan that allow it? –  solefald Apr 21 '10 at 15:10

2 Answers 2

Have you enabled packet forwarding by the kernel?

echo 1 > /proc/sys/net/ipv4/ip_forward

Can you also paste your full iptables rules?

share|improve this answer
    
Hi Yes packet forwarding is enabled by the kernel. I have pasted my full iptables rules in my next post. –  Supratik Apr 22 '10 at 4:02

Seems like you're forgetting to NAT the FORWARD traffic. Try adding the following rule:

$IPT -t nat -A POSTROUTING -o eth0 -j SNAT -to-source $PUBLICIP

This will make sure that all traffic going out eth0 will not leak internal IP addresses and should solve your problem.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.