1

I'm trying to set up a bastion network with lan access to internet. This is my diagram.

enter image description here

I have internet acces in the linux firewall (I'm using a lubuntu 16.04). And I can ping from lubuntuclon (192.168.10.2) to the firewall (192.168.10.1) perfectly. So I think is working. The problem is that I cannot acces internet from the LAN. I think it's a matter of iptables but It's not working as expected. This are the iptables rules I'm using:

Flush the rules:

iptables -F
iptables -X
iptables -Z
iptables -t nat -F

Politics:

iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT

Rules:

iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -s 192.168.10.0/24 -i enp0s8 -j ACCEPT -->so the LAN has access to the firewall
iptables -t nat -A POSTROUTING -s 192.168.10.0/24 -o enp0s3 -j MASQUERADE  --> so the lan has internet access

but when I ping 8.8.8.8 from lubunutuclon or winxpclon I got no response. I cannot acces internet from browser neither, of course.

I think my rules are wrong. But I cannot figure why. Any help?

1 Answer 1

1

I think you forgot to enable ip forwarding on the Linux firewall:

# sysctl -w net.ipv4.ip_forward=1
6
  • I try it, but it didn't work. Still can't ping the linuxfirewall or the lubuntuclon. However, if I run tcpdump -i enp0s3 I can see the response packets but they go trough enps03 instead of enp0s8, any idea? and thanks for your help!
    – Peyu
    Jul 25, 2017 at 18:19
  • Do you see Something with tcpdump on enp0s8 (while testing ping) : ARP frames, ICMP packets ? Jul 25, 2017 at 21:22
  • I'm not sure why, but I can ping ok now. (I think the ip forwarding do works after all). The firewall see and respond to the pings of lubuntuclon. Now I need to access internet from lubuntuclon. What iptables rules do I need to set? thank you for yor help.
    – Peyu
    Jul 26, 2017 at 1:04
  • You do not need any other rule, since the default policy is ACCEPT. It should already work correctly. Jul 26, 2017 at 1:08
  • mmm... are you sure I'm not missing some Nat rule? Beacause I cannot acces internet from lubuntuclon. I think the linux firewall needs to translate the 192.168.10.5 (lubuntu address) to 192.168.1.2. I'm trying that, but still no success...
    – Peyu
    Jul 26, 2017 at 4:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .