I'm attempting to setup a nat router for a lab to simulate a private network connected to a WAN. I have three virtual machines:
- public ip 192.168.0.5/24
- private ip 172.16.0.5/24
- router 192.168.0.1/24 (eth0), 172.16.0.1/24 (eth1)
I started by configuring each system's networking and confirmed I could ping from private->router and back and public->router and back.
Then I set
net.ipv4.ip_forward to 1 using
sysctl.conf, and applied the changes.
At this point I was unable to ping private to public and public to private. Flushing router's iptables rules fixed the problem.
iptables -F iptables -t net -F iptables -t mangle -F iptables -X iptables -t nat -X iptables -t mangle-X
Then following the guide for CENTOS6/RHEL6 I issued these iptables commands to setup forwarding
iptables -A FORWARD -i eth1 -j ACCEPT iptables -A FORWARD -o eth1 -j ACCEPT iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
The confusion begins. I am able to ping from private to public, using a tcp dump I can confirm the IP address is masquerading correctly. However I am also able to ping from public to private.
Here is a dump of linux router's
*mangle :PREROUTING ACCEPT [0:0] :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] COMMIT *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A FORWARD -i eth1 -j ACCEPT -A FORWARD -o eth1 -j ACCEPT COMMIT *nat :PREROUTING ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A POSTROUTING -o eth0 -j MASQUERADE COMMIT
I've played around with adding rejects, input state related/established. I can't seem to keep the supposedly pubic host from peering into the private network. Any ideas? I'm sure I have something wrong.