1

I have a box setup as DHCP Server with NAT ipv4 forwarding enabled. Currently the box uses eth0 to connect to a local network and has access to the internet, it has another 3 interfaces, eth1, eth2 and eth3 which connect to other boxes. The 3 other boxes can all talk to one another and the primary box.

I'd like to allow the other 3 boxes to access the internet via the primary box over it's eth0 interface so I believe I need to setup iptable rules. There's no special port rules or anything specific, I'd just like traffic from eth1, eth2 and eth3 to go through eth0 when accessing the public internet.

for thoroughness here is my /etc/network/interface file

auto lo

iface lo inet loopback
iface eth0 inet dhcp

iface eth1 inet static
  address 192.168.1.1
  netmask 255.255.255.0

iface eth2 inet static
  address 192.168.2.1
  netmask 255.255.255.0

iface eth3 inet static
  address 192.168.3.1
  netmask 255.255.255.0

From the information here on SO and around the web this is what my iptables-save currently look like

*nat
:PREROUTING ACCEPT [1799:327587]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [23:2190]
-A POSTROUTING -j MASQUERADE 
COMMIT
*filter
:INPUT ACCEPT [3474:500657]
:FORWARD ACCEPT [24:1613]
:OUTPUT ACCEPT [857:128814]
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT 
-A FORWARD -s 192.168.1.101 -i eth1 -o eth0 -m conntrack --ctstate NEW -j ACCEPT 
-A FORWARD -s 192.168.2.102 -i eth2 -o eth0 -m conntrack --ctstate NEW -j ACCEPT 
-A FORWARD -s 192.168.3.103 -i eth3 -o eth0 -m conntrack --ctstate NEW -j ACCEPT 
COMMIT

The rules are persistant on reboot via pre-up

Since I do not have a good understanding of iptable rules the current questions on serverfault are hard to follow / understand what I'm actually doing.

3 Answers 3

1

There are some problems with how you wrote your rules.

-A POSTROUTING -j MASQUERADE 

This rule applies too broadly. You only need such rule for connections from the LAN leaving your network. One way to do that would be to specify which outgoing interface it applies to:

-A POSTROUTING -o eth0 -j MASQUERADE 

Additionally your filter table does not make much sense:

*filter
:INPUT ACCEPT [3474:500657]
:FORWARD ACCEPT [24:1613]
:OUTPUT ACCEPT [857:128814]
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT 
-A FORWARD -s 192.168.1.101 -i eth1 -o eth0 -m conntrack --ctstate NEW -j ACCEPT 
-A FORWARD -s 192.168.2.102 -i eth2 -o eth0 -m conntrack --ctstate NEW -j ACCEPT 
-A FORWARD -s 192.168.3.103 -i eth3 -o eth0 -m conntrack --ctstate NEW -j ACCEPT 
COMMIT

Each of your rules ACCEPT packets according to certain criteria. However it is all redundant since in the end you are going to ACCEPT them with the default policy for the chain. So the outcome is that you ACCEPT everything, which would also be the case if you removed all the rules.

3
  • Thank you for response, I've look more deeply into iptables now along with your answer.Would it make sense to use a rule instead like iptables -A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT & iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT? I'm not sure that it's correct in every respect but it seems to more appropriately attempt my goals (though it does not work).
    – rwxes
    Nov 24, 2014 at 8:43
  • @rwxes As long as all your rules say ACCEPT and your default policy says ACCEPT it doesn't matter what you write in the rules or if you have any rules at all, since the outcome is always going to be ACCEPT. And you don't need any filter rules whatsoever to get NAT working. You have to figure out what you are trying to achieve with those rules.
    – kasperd
    Nov 24, 2014 at 8:53
  • Thankyou! I've re-read the docs and everything is much clearer now, I just couldn't get my head around it. Sorry to make you repeat yourself like that but it's really helped. Will upvote when I get the rep.
    – rwxes
    Nov 24, 2014 at 9:16
2

Before one jumps straight into firewall rules, one should also perform a simple forwarding check. Rather like when one checks the power cord is plugged in before taking apart the hardware.

Run:

cat /proc/sys/net/ipv4/ip_forward

If you get a zero, IPv4 will not forward. You'll need to turn this on.

To turn it on immediately and ephemerally to verify behavior:

echo 1 > /proc/sys/net/ipv4/ip_forward

The above turns it on for the machine but is simply modifying a kernel setting on the fly and will not be "saved".

Edit the sysctl.conf file to make the proper permanent change and ensure the following setting:

net.ipv4.ip_forward = 1
2
  • yes, thank you for being thorough, as mentioned here "DHCP Server with NAT ipv4 forwarding enabled" is enabled and cat /proc/sys/net/ipv4/ip_forward returns 1. To confirm sysctl.conf was already modified. My problem seems to be that I'm not able to connect from the other boxes to the internet, though I can connect to them from the primary box.
    – rwxes
    Nov 24, 2014 at 5:44
  • You are correct, but the answer I provided isn't just for you. I'd be willing to bet that 90% of the people coming into ServerFault via a search engine link to your question wouldn't read that particular nuance into the sentence you quoted.
    – Magellan
    Nov 25, 2014 at 4:37
1

In addition to Magellan's answer, do not use -j MASQUERADE, unless you really know what that does and must use it. Instead use -j SNAT --to <source address>. Second, your POSTROUTING rule needs to include -o eth0, otherwise it is MASQUERADEing connections coming back in as well, which your internal boxes probably have no idea how to handle.

1
  • thank you, I have read more about -j MASQUERADE and agree that -j SNAT --to <source address> should be used instead. I'll upvote when I get the rep!
    – rwxes
    Nov 24, 2014 at 8:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .