What 'exactly' does NETfilter/iptables do when you enable forwarding and masquerading

Question

I'm setting up firewall rules and even though I thought I understood netfilter and iptables, I am confused about what exactly happens when you set 1 to net.ipv4.ip_forward and make a MASQUERADE rule.

Does enbaling forwarding mean that every incoming IP packet is basically retransmitted and sent according to the routing table? Or does it simply sent it out on all network interfaces?

The MASQUERADE rule is postrouting and matches everything sent to the internet interface. This seems to suggest that enabling forwarding sents IP packets to every interface and this MASQ rule does something special (NAT'ing) for the internet interface.

My next question would then be if all incoming traffic to the NAT router is simply transmitted on the LAN interface (albeit with non-working addresses). Does that mean that I need to make special DROP rules in FORWARD to prevent unnecessary trafic from being generated?

And if so, does that in turn mean that for every PREROUTING rule I need another in FORWARD?

edit: as a sidenote: my confusion stems from a task I need to do: I forwarded port 80 to an internal server. This works fine from outside our network, but I can't reach it when I try to connect to the WAN IP from within the network. My rule is:

iptables -t nat -A PREROUTING -d WANIP -p tcp -m tcp --dport 80 -m comment --comment "Forward www to <machine>." -j DNAT --to-destination 10.50.0.4

Answer 1

Enabling forwarding allows the machine to route packets to other hosts, and yes, it consults the routing table and only sends it to the correct interface. With forwarding disabled, all packets not destinated to this machine are discarded.

However, there is only a single instance of each table per system, not per-interface tables. So the packets get processed by Netfilter regardless of where they get routed, and you have to filter over the destination interface by hand in the rules.

Masquerading replace the source IP adress with the one of the outgoing interface, so that the request appears to come from the router, and not from the private NATted address. It also keeps track of the connection status, so that when replies arrive they can be directed to the original source host.

DNAT happens in PREROUTING and SNAT/MASQUERADE in POSTROUTING, so all the steps in between (filtering by FORWARD, notably) always sees the effective, "end-to-end" adresses. You have to write your forward rules like NAT was non-existent and your private address space was routable.

Your problem most likey stems from the fact that your FORWARD rules do not allow forwarding from the lan to the lan (which would be reasonable in the absence of that kind of internal NATting). Since DNAT happens before FORWARD, when FORWARD looks at it, the destination address has already been changed to the lan one.

Answer 2

I solved the problem. In short, it’s because the reply the machine your connecting to makes, goes back to the LAN IP directly, and not back through the router. This article explains it well.

Aside from the rule above, I made this rule to fix it:

iptables -t nat -A POSTROUTING -p tcp --source 10.50.0.0/16 --dest 10.50.0.4 --dport 80 -j SNAT --to-source 10.50.0.1

10.50.0.1 is the router, 10.50.0.4 is the machine to which it's forwarded.