Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to setup my Debian Lenny server as a router for my home network using iptables, but so far have been unsuccessful. Below is a diagram of the desired network architecture

 INTERNET - (eth0) Debian server + router (eth1) -- Netgear 5 port gigabit switch  -- Clients

I have a DHCP server and a DNS server running for the internal network but I am having difficulty setting up iptables. I need port 80 and 22 open from outside (I can add the open others later) and full access to the server from inside.

Any help would be very greatly appreciated, Thanks, RayQuang

share|improve this question
up vote 4 down vote accepted

Here is a setup I've used with great success in an almost identical situation to yours. I understand your circumstances to be as follows (please correct me if I'm wrong):

  • Clients on the LAN have full access to the internet. Outgoing connections from LAN clients are masqueraded to the public IP address given to your server/router by your ISP.
  • Clients on the LAN have full access to your server via its LAN-connected interface (eth1).
  • All incoming internet traffic (via eth0) is blocked, except for: (1) traffic involved in a preexisting connection, (2) traffic bound for TCP ports 22 or 80, or (3) ICMP ping requests.
  • TCP Ports 22 and 80 are open to the internet (via eth0) and are handled by your server.
  • Your server responds to ICMP ping requests from the internet.
  • For convenience, I will assume your LAN network address range is Modify the script below as needed to use your actual address.

First, ensure that IP forwarding is turned on. In /etc/sysctl.conf, you should have this:


Then, create your netfilter rules as per the following script:


# Flush all chains, to start with a clean slate.
$IPT -t nat -F

# Set filter Policies. By default, DROP everything.

# Set server INPUT rules.
$IPT -A INPUT -i eth1 -j ACCEPT
$IPT -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
$IPT -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
$IPT -A INPUT -p icmp -m icmp --icmp-type echo-request -j ACCEPT

# Set server OUTPUT rules.

# Set router FORWARD rules.
$IPT -A FORWARD -i eth1 -o eth0 -j ACCEPT

# Masquerade outgoing LAN traffic.
$IPT -t nat -A POSTROUTING -s -o eth0 -j MASQUERADE

This should be enough of a framework to build upon.

share|improve this answer
Many thanks, I managed to get it working flawlessly :). IPtables is much more advanced and defiantly more powerful than my previous router. Im planning to implement some sort of QOS system that will prioritize VOIP and web/mail server connection sometime in the future. Thanks again, RayQuang – RayQuang Dec 13 '10 at 10:11

You need a set of rules like the following:

$ sudo iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
# Forward SSH packets destined to port 22
$ sudo iptables -A FORWARD -i eth0 -o eth1 -p tcp -m tcp --dport 22 -j allowed
# Forward HTTP packets destined to port 80
$ sudo iptables -A FORWARD -i eth0 -o eth1 -p tcp -m tcp --dport 80 -j allowed
# NATing rules for SSH and HTTP
$ sudo iptables -A PREROUTING -d your_public_ip -p tcp -m tcp --dport 22 -j DNAT --to-destination your_private_ip:22
$ sudo iptables -A PREROUTING -d your_public_ip -p tcp -m tcp --dport 80 -j DNAT --to-destination your_private_ip:80

Please, note that these rules might not be the complete list. However, it will help you get started. Also, don't forget to enable IP forwarding!

share|improve this answer
Hi, Thanks for your prompt answer, the problem with this is that I have a dynamic IP address and do not want to change the ip each time. Would there be a way to specify the interface rather than the ip. Thanks, RayQUang – RayQuang Dec 12 '10 at 10:18
You can specify interface and/or IP according to your needs. The interface can be specified using -i eth0 as in FORWARD rules. – Khaled Dec 12 '10 at 10:52
If you have a dynamic IP, don't forget to get a dynamic DNS provider (such as NoIP or DynDNS, for example) and use ddclient to keep your local external IP updated. – LawrenceC Dec 12 '10 at 11:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.