Cable Forum - Finally made the jump....setting up NAT on linux

After promising my self for years that i would upgrade my gateway box from win2k server using NAT to Linux i finally did it yesterday.

I was shocked at how simple it actually is to set up the NAT/firewall on Linux and thought i would supply a few bits of information I found on various different web sites incase anyone else also wishes to do this.

firstly chose your linux :) i chose redhat 9 as i have used redhat before and it has a cool logo :P

i did i full install (about 2 gigs with all the extras but you dont need all this).

log onto your machine and start a terminal session type "su" and and then your password to become root.

fire up your favourite text editor and open the file /etc/rc.d/rc.local and add the following at the end of the file /etc/rc.d/rc.ipmasq Save this and close but keep the editor open. (this will execute the script you are about to create on startup.)

Now create a new file in /etc/rc.d/ called rc.ipmasq and add the below data.

Code:

#!/bin/sh

IPTABLES=/sbin/iptables

 

#All The lines below are NAT routing

# flush any old rules

$IPTABLES -F -t nat

 

# turn on NAT (IP masquerading for outgoing packets)

$IPTABLES -A POSTROUTING -t nat -o eth0 -j MASQUERADE

 

# enable IP forwarding (of incoming packets)

echo 1 > /proc/sys/net/ipv4/ip_forward

save this file.

This script assumes that eth0 is the network adaptor connected to the cable modem (you can change this depending on your machine config eth1, eth2 etc. in the case of a modem/dsl setup you can use ppp1 ppp2 etc.)

Make this script executable by running the command
chmod 755 /etc/rc.d/rc.ipmasq

now run the command /etc/rc.d/rc.ipmasq to start the script without having to reboot.

this script assumes that all network and internet connections have been previously set up and are working.

I recomend you also set up some form of firewall, instructions for a basic firewall using IPtable follow.

Firstly, open the file /etc/rc.d/rc.local again in your text editor and add the line /etc/rc.d/rc.firewall at the end, close the file and save again.

now open a new file and save it in /etc/rc.d/ as rc.firewall.

add the following text

Code:

#!/bin/sh



#Change the part after the = to the where you IPTABLES is on your system

IPTABLES=/sbin/iptables

 

#flush existing rules

$IPTABLES -F INPUT

 

#This allows all data that has been sent out for the computer running the firewall

# to come back 

#(for all of ICMP/TCP/UDP).

#For example, if a ping request is made it will allow the reply back

$IPTABLES -A INPUT -j ACCEPT -m state --state ESTABLISHED -i eth0 -p icmp

$IPTABLES -A INPUT -j ACCEPT -m state --state ESTABLISHED -i eth0 -p tcp

$IPTABLES -A INPUT -j ACCEPT -m state --state ESTABLISHED -i eth0 -p udp



#Allow traffic from ethernet adapter eth1 to pass through if 

#you have a network, or 

#as using linux as a router for internet etc. 

#Your first ethernet card is eth0 and the second would be eth1 etc. 

#$IPTABLES -A INPUT -i eth1 -j ACCEPT



#Allow incoming FTP requests

#$IPTABLES -A INPUT -p tcp --dport 20 -j ACCEPT

#$IPTABLES -A INPUT -p tcp --dport 21 -j ACCEPT

#Allow incoming SSH requests

$IPTABLES -A INPUT -p tcp --dport 22 -j ACCEPT

#Allow incoming HTTP requests (to Web server)

#$IPTABLES -A INPUT -p tcp --dport 80 -j ACCEPT



#Allow Ping echo

#I have commented this line, so ping from an outside machine will not work.

#Uncomment the next line to make ping from outside work.

#$IPTABLES -A INPUT -p icmp -j ACCEPT



#Drop and log all other data

#The logging is set so if more than 5 packets are dropped in 

#three seconds they will be ignored. This helps to prevent a DOS attack

#Crashing the computer the firewall is running on 

$IPTABLES -A INPUT -m limit --limit 3/second --limit-burst 5 -i ! lo -j LOG

$IPTABLES -A INPUT -i ! lo -j DROP

#The logs from the firewall are put into your system log file, which can be found at 

#/var/log/syslog

save the file and run chmod 755 /etc/rc.d/rc.firewall to make the script executable.

run /etc/rc.d/rc.firewall to start the firewall without needing to restart.

Remember this firewall is by no means perfect, but it does provide a basic level of protection and make you "stealthed". (Stealthed means that your computer is invisible to most kinds of tests, but again this is not perfect)

if any one has made it this far then i hope this has been usefull, i will be trying to post more stuff for linux in the future, if any one has any requests, just ask :)

hth

ava