I'm setting up firewall rules and even though I thought I understood netfilter and iptables, I am confused about what exactly happens when you set 1 to net.ipv4.ip_forward and make a MASQUERADE rule.
Does enbaling forwarding mean that every incoming IP packet is basically retransmitted and sent according to the routing table? Or does it simply sent it out on all network interfaces?
The MASQUERADE rule is postrouting and matches everything sent to the internet interface. This seems to suggest that enabling forwarding sents IP packets to every interface and this MASQ rule does something special (NAT'ing) for the internet interface.
My next question would then be if all incoming traffic to the NAT router is simply transmitted on the LAN interface (albeit with non-working addresses). Does that mean that I need to make special DROP rules in FORWARD to prevent unnecessary trafic from being generated?
And if so, does that in turn mean that for every PREROUTING rule I need another in FORWARD?
edit: as a sidenote: my confusion stems from a task I need to do: I forwarded port 80 to an internal server. This works fine from outside our network, but I can't reach it when I try to connect to the WAN IP from within the network. My rule is:
iptables -t nat -A PREROUTING -d WANIP -p tcp -m tcp --dport 80 -m comment --comment "Forward www to <machine>." -j DNAT --to-destination 10.50.0.4