Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to make a quick-and-dirty NAT out of a Ubuntu 10.10 box. Just "this side is NATted with DHCP handing out 192.168.x.0/24" and "this side gateways to the Internet", and nothing else interesting. There seems to be many choices with varying degrees of documentation. What's the easiest way to do this?

share|improve this question
up vote 2 down vote accepted
echo "net.ipv4.ip_forward=1" >> /etc/sysctl.d/10-network-security.conf
iptables -t nat -A POSTROUTING -s -o externaleth -j SNAT --to externalip
apt-get install dhcp3-server
gedit /etc/default/dhcp3-server
interfaces="internaleth1" #eth2 or eth3 or whatyouhave :D
gedit /etc/dhcp3/dhcpd.conf
subnet netmask {
    option routers        ; #yours itnernal ip
    option subnet-mask    ;

    option domain-name              "";
    option domain-name-servers;

apt-get install dns-masq
service dhcp3-server restart
  1. setting nat
  2. install dhcpd-server
  3. install dnsmasq to handle option domain-name-servers; or you could set it to and skip install dns-masq
share|improve this answer
dnsmasq also does DHCP. If you're going to install dnsmasq, I wouldn't don't bother with dhcp3-server. – Steven Monday Apr 12 '11 at 15:07
ive got some problems with vpn-s and dhcpd dnsmasq. and i dont know why that worked for me. now im having my own bind9 for that :D – MealstroM Apr 13 '11 at 6:12
The iptables part of this answer works fine. There is, I think, at least one bug in the dhcpd stuff, namely that the interface in /etc/default/dhcp3-server should be the internal interface (where systems send their DHCP requests", not the external one. – Paul Hoffman Apr 24 '11 at 17:59
@Paul Hoffman you are right. – MealstroM Apr 25 '11 at 8:58
And a late comment because this came and bit me on the butt late in the game: do not forget to "echo 1 > /proc/sys/net/ipv4/ip_forward" every time you boot this box. – Paul Hoffman May 17 '11 at 2:33

I in fact do exactly this -- for a couple of years an old HP mini-tower served as my home network's router, until it fried in a blackout (hardware's not worth troubleshooting the fault); I'll be building a brand new system for this very same purpose shortly, so I'll be sure to write up a how-to as I do that.

In the meantime, however, I'll point you to the same resource I use: Shorewall, and specifically the how-to for a two-interface firewall. The site's documentation also has similar articles for one- and three-interface setups, so pick the one that best suits your needs. I find using Shorewall to be a lot easier and a lot more intuitive than directly manipulating iptables (Shorewall is really just a configuration layer that sits atop iptables, so the end result is very much the same, except that it handles a lot of basic, low-level stuff you wouldn't even think of, like smurfs (packets with a broadcast address as the source) and martians (packets with impossible source addresses)).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.