0

I am trying to set up a system to do NAT and other iptables-stuff (like logging, firewall, monitoring, etc.). The ISP provides a dynamic IP address and the DSL modem does NAT.

I have the following "small-business" configuration:

192.168.1.1           |-----------|
----------------------|           |
                      |  SWITCH 1 |
192.168.1.2           |           |
----------------------|           |
                      |           |
192.168.1.3           |           |
----------------------|           |
                      |-----------|
                           |
                           | 192.168.1.4
                           |
                     |--------------|
                     | Dual NIC     |
                     | IPTABLES m/c | NAT
                     |--------------|
                           |
                           |
                           |192.168.2.2
                           |
                     |--------------| 192.168.2.1 |----------------|
                     |  SWITCH 2    | ------------|DSL Modem NAT   |
                     |--------------|             |----------------|

My goals are to control what each node on 192.168.1.x LAN can do, log entries, etc. The IPTABLES machine will be doing a lot more than what the Iptables CLI can... Some C interface to the libnetfilter_queue library is expected as we need to do some custom monitoring and logging.

I do not have a static Public IP address. So, I need to depend on the NAT built in the DSL. Effectively I will end up with two NATs in series. One SNAT through IPTables with source changed to 192.168.2.2. The second is the one that the DSL modem will do to change source IP from 192.168.2.2 to whatever is the public Internet IP assigned at the time.

I think that there must be a better approach. What is it? Or am I totally offtrack?

  • @DougSmythies I was complicating the IPTables rules. All I did now was to enable forwarding and set one IPTables rule (other than several logging rules): iptables -t nat -A POSTROUTING -o em2 -j SNAT --to 192.168.2.2 And it works! All computers on 192.168.1.0 are able to access the net and I am able to log whatever I need through the --log-prefix option. Is it really that simple or is this too good to be true? Also, if you enter your first comment as an answer, I will accept it. – Sunny Apr 27 '15 at 15:14
1

You do not need to depend on the NAT in the DSL modem, you can still do it on the Ubuntu router box, even with a dynamic public IP address.
You wouldn't want to do it unless you are confident in the security of your iptables rule set.
Sometimes DSL modem/routers have no option to turn off the router (NAT) stuff, in which case what you are doing is fine.

And yes, with default policies of ACCEPT, and forwarding enabled,

$ cat /proc/sys/net/ipv4/ip_forward
1

it is as simple as the one POSTROUTING rule (copied from your comment):

iptables -t nat -A POSTROUTING -o em2 -j SNAT --to 192.168.2.2

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.