1
eth0 (192.168.1.0/24) --> wan
eth2 (192.168.10.0/24) --> lan0

I use these rules to enable NAT on my linux gateway:

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A FORWARD -i eth2 -o eth0 -j ACCEPT
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

why on some online howto I read some rules like these?

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A FORWARD -s 192.168.10.0/24 -d 0/0 -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -d 192.168.10.0/24 -j ACCEPT
iptables -A FORWARD -s 192.168.10.0/24 -j ACCEPT
iptables -A FORWARD -d 192.168.10.0/24 -j ACCEPT
1

If you use these two lines:

iptables -A FORWARD -s 192.168.10.0/24 -j ACCEPT
iptables -A FORWARD -d 192.168.10.0/24 -j ACCEPT

Then these two has no value as far as the security is concerned:

iptables -A FORWARD -s 192.168.10.0/24 -d 0/0 -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -d 192.168.10.0/24 -j ACCEPT

At first you have iptables -A FORWARD -s 192.168.10.0/24 -d 0/0 -j ACCEPT, this will make iptables forwarding packets originating from 192.168.10.0/24 subnet destined to 0/0 meaning every other networks. Again later you have iptables -A FORWARD -s 192.168.10.0/24 -j ACCEPT,actually in practice these two rules mean the same.

For iptables -A FORWARD -m state --state ESTABLISHED,RELATED -d 192.168.10.0/24 -j ACCEPT will make iptables to accept and forward any packet destined to 192.168.10.0/24 only if the packet is originated from a ESTABLISHED or RELATED source. Later you have somewhat conflicting rule iptables -A FORWARD -d 192.168.10.0/24 -j ACCEPT which will forward any packets destined for 192.168.10.0/24 making the first rule useless as any packet destined for 192.168.10.0/24, that will not match the first rule will match this one and the packet will be forwarded no matter what.

  • thanks for your reply, does the first lines correct? or I need to do modify it? – watchmansky Apr 9 '15 at 20:43
  • The first line iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE is Ok. – heemayl Apr 9 '15 at 20:46
  • sorry, I mean: the rules on FORWARD chain are correct? – watchmansky Apr 9 '15 at 20:48
  • Yes, seems Ok.. – heemayl Apr 9 '15 at 20:50
  • 1
    Also note that by just using iptables -A FORWARD -m state --state ESTABLISHED,RELATED -d 192.168.10.0/24 -j ACCEPT for packets destined for the subnet, you won't get any packet initiated from outside..only the packets that are originated from the subnet and are actually response to the earlier packets will be accepted as indicated by ESTABLISHED and RELATED – heemayl Apr 9 '15 at 20:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.