Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Where is the documentation on how to configure a plain Linux box (probably running Ubuntu), with two NIC's so that eth0 is the input from the Internet and eth1 is the output to a wireless router?

While the traffic is passing through, I'd like to analyze it.

share|improve this question

6 Answers 6

up vote 4 down vote accepted

Use an existing firewall distribution such as smoothwall or ipcop. That will save you a ton of trouble and headache later. If you really want to get into the nitty-gritty of advance router configuration, check out LARTC.

share|improve this answer
I have a smoothwall setup on a very old machine exactly like this. Smoothwall is a 10-minute Linux install – cop1152 Sep 5 '09 at 12:35

this is nothing special, all you need is a good firewall script or framework that will NAT your traffic.

Take a look at this link to get started:

Searching google will return countless hits as this topic has been thoroughly investigated.

share|improve this answer

I use shorewall running on ubuntu. Very easy to set up and maintain, but it still has all the options you will likely need:

share|improve this answer
+1 for shorewall – dmityugov Sep 5 '09 at 12:44

Here's a script I use on some debian systems:

## This script starts an NAT internet gateway

## Settings
# Internal Interface
# External Interface

## Ensure the modules are loaded
# Load the NAT module
modprobe iptable_nat
# Load the transparent FTP modules
modprobe ip_nat_ftp
modprobe ip_conntrack_ftp
# Load the transparent IRC modules
modprobe ip_nat_irc
modprobe ip_conntrack_irc

modprobe ipt_MASQUERADE
modprobe ipt_REDIRECT
modprobe ipt_REJECT
modprobe iptable_filter
modprobe ip_conntrack
modprobe ip_tables

## Flush the routing tables
iptables --flush
iptables --table nat --flush
iptables --delete-chain
iptables --table nat --delete-chain

## Set up the NAT table
iptables --append FORWARD --in-interface $INTERNAL -j ACCEPT

# Ensure that IP forwarding is on
echo 1 > /proc/sys/net/ipv4/ip_forward
share|improve this answer

You might also look at m0n0wall. A guy in my local LUG uses it extensively.

share|improve this answer
"the first UNIX system that has its boot-time configuration done with PHP" (m0n0wall homepage) - perversion! And Scott asked for a Linux gateway, m0n0wall is BSD. – 0x89 Sep 5 '09 at 14:42
good point - didn't realize it was BSD only – warren Sep 6 '09 at 2:37

To analyze the traffic, you can use tcpdump

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.