I need to set up routing, preferably with iptables, that does no NAT. Basically I will have a number of clients on subnet 192.168.1.0/24 and they need their traffic to go through a gateway, say 192.168.1.1 and that gateway then passes on the request, without translating the original address, to another gateway, say 192.168.0.100. What I really want to do is use iptables so I can configure a fine grain firewall to do the routing but all I can find info on is how to do this with NAT. Which I have done before. Any insight on how to do the routing without NAT?
7
-
1"assigning us a Class C subnet" -- I'll bet they aren't.– womble ♦Aug 5, 2012 at 0:08
-
Our institution owns a Class B block of public addresses. They are assigning us a Class C block. Why do you say they are not?– Erik WeissAug 5, 2012 at 0:12
-
4If your institution "owns" a class B subnet, they cannot, by the very definition of a classful addressing, assign you a class C subnet out of that block. Cannot be done. That's before we start into the issue of classful addressing being declared obsolete over 20 years ago...– womble ♦Aug 5, 2012 at 0:20
-
Fair enough, call it what you like, but they are "allocating" us a class C subnet of addresses and I am stumped on how to do the routing with iptables. I will edit my original question to generalize it.– Erik WeissAug 5, 2012 at 0:27
-
2They're not allocating you a class C subnet either. Classful addressing is dead.– womble ♦Aug 5, 2012 at 0:38
|
Show 2 more comments
2 Answers
Routing without NAT is just like routing with NAT... only without the NAT. You add routing table entries to indicate next-hop destinations.
Firewalling without NAT is just like firewalling with NAT... only without the NAT. You add firewall rules to permit traffic with certain attributes (source/dest addresses and ports, protocols, state parameters, etc) in like with organisational policy.
No need nat here, add your deny/accept rules to FORWARD chain of filter table,
also don't forget to enable forwading on both devices:
echo 1 > /proc/sys/net/ipv4/conf/all/forwarding
or setup it via sysctl (net.ipv4.conf.all.forwading=1 in /etc/sysctl.conf)
