My personal notes on all things technical and factual....

Clayton's Tech Bits

Search this site:

Custom Search

Thu, 21 Jul 2011

/Admin/iptables: Build A Router With iptables

This[1] is a deeper reference, but it did not quite get the job done for me. (Nor did a lot of other recipes I looked at either, for that matter....) The "Example Scenario: SOHO" here[2] got me a working router.

First make sure forwarding is enabled in your router OS. The standard way to do this on Debian is to edit /etc/sysctl.conf to turn on net.ipv4.ip_forward. My machine is not a full-time router, so I added a

up echo 1 > /proc/sys/net/ipv4/ip_forward

line to the /etc/network/interfaces clause that brings up my internal LAN interface, ie.

iface static inet static
  address 10.1.1.1
  netmask 255.255.255.0
  network 10.1.1.0
  broadcast 10.1.1.255
  up echo 1 > /proc/sys/net/ipv4/ip_forward

Then I added these lines to my "basic firewall":

-A POSTROUTING -o eth0 -j MASQUERADE

-A INPUT -s 10.1.1.0/24 -i eth4 -m state --state NEW,ESTABLISHED -j ACCEPT
-A FORWARD -s 10.1.1.0/24 -i eth4 -m state --state NEW,ESTABLISHED -j ACCEPT
-A FORWARD -d 10.1.1.0/24 -i eth0 -m state --state ESTABLISHED -j ACCEPT
-A OUTPUT -d 10.1.1.0/24 -o eth4 -m state --state NEW,ESTABLISHED -j ACCEPT

where eth0 is the outward/WAN interface, eth4 is the inward/LAN interface, and 10.1.1.0/24 is the IP address block used on the LAN. Note that only ESTABLISHED, not NEW, connections are allowed to come in on eth0/WAN.

To configure DHCP[3] add this line to rules.v4:

-A INPUT -i eth4 -p udp -m udp --sport 67:68 --dport 67:68 -j ACCEPT

and

apt-get install dnsmasq

Just configure the dhcp-range in /etc/dnsmasq.conf, ie.

dhcp-range=10.1.1.50,10.1.1.150,12h

and it should be all ready to go.

[1] http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_:_Ch14_:_Linux_Firewalls_Using_iptables#Masquerading_.28Many_to_One_NAT.29
[2] http://fedorasolved.org/Members/kanarip/iptables-howto
[3] http://www.faqs.org/docs/iptables/lettingdhcprequests.html

posted at: 03:52 | path: /Admin/iptables | permanent link to this entry

Home

Contact

Resumé / C.V.

Links

Categories:

Archives:

Subscribe XML RSS Feed

Thu, 21 Jul 2011