1

I'm attempting to setup a nat router for a lab to simulate a private network connected to a WAN. I have three virtual machines:

  • public ip 192.168.0.5/24
  • private ip 172.16.0.5/24
  • router 192.168.0.1/24 (eth0), 172.16.0.1/24 (eth1)

I started by configuring each system's networking and confirmed I could ping from private->router and back and public->router and back.

Then I set net.ipv4.ip_forward to 1 using sysctl.conf, and applied the changes.
At this point I was unable to ping private to public and public to private. Flushing router's iptables rules fixed the problem.

iptables -F
iptables -t net -F
iptables -t mangle -F
iptables -X
iptables -t nat -X
iptables -t mangle-X

Then following the guide for CENTOS6/RHEL6 I issued these iptables commands to setup forwarding

iptables -A FORWARD -i eth1 -j ACCEPT
iptables -A FORWARD -o eth1 -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

The confusion begins. I am able to ping from private to public, using a tcp dump I can confirm the IP address is masquerading correctly. However I am also able to ping from public to private.

Here is a dump of linux router's /etc/sysconfig/iptables file

*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A FORWARD -i eth1 -j ACCEPT
-A FORWARD -o eth1 -j ACCEPT
COMMIT
*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT

I've played around with adding rejects, input state related/established. I can't seem to keep the supposedly pubic host from peering into the private network. Any ideas? I'm sure I have something wrong.

  • Could the issue be having the public client which has an IP of 192.168.0.5 configured to use 192.168.0.1 as its gateway? In reality the Linux OS running the NAT shouldn't be used as anyone's gateway on the public network. – pacmanwa Oct 9 '16 at 20:26
  • Nevermind, if a public host does try to use my Linux os as a gateway, I still have the problem of it coming in. Its still a security issue. – pacmanwa Oct 9 '16 at 21:24
0

Your default policy for the filter table should be DROP, not ACCEPT, else you forward all packets by default.

iptables -P FORWARD DROP
  • Running this makes no changes to the result. I can still ping through from the public address to the private. – pacmanwa Oct 9 '16 at 19:30
0

I finally figured it out! First, flush iptables like before:

iptables -F
iptables -t net -F
iptables -t mangle -F
iptables -X
iptables -t nat -X
iptables -t mangle -X

Setup filter policies

iptables -P OUTPUT ACCEPT
iptables -P INPUT ACCEPT
iptables -P FORWARD DROP

Then setup masquerading

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Then setup a filter to prevent routing to your private interface. This keeps public hosts from using the router as a gateway. Without this I can ping the private interface of the router from public.

iptables -A INPUT -i eth1 -j ACCEPT
iptables -A INPUT -j DROP

Finally, setup forwarding

iptables -A FORWARD -i eth1 -j ACCEPT
iptables -A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.