CentOS 6 iptables nat router

Question

I'm attempting to setup a nat router for a lab to simulate a private network connected to a WAN. I have three virtual machines:

• public ip 192.168.0.5/24
• private ip 172.16.0.5/24
• router 192.168.0.1/24 (eth0), 172.16.0.1/24 (eth1)

I started by configuring each system's networking and confirmed I could ping from private->router and back and public->router and back.

Then I set net.ipv4.ip_forward to 1 using sysctl.conf, and applied the changes.
At this point I was unable to ping private to public and public to private. Flushing router's iptables rules fixed the problem.

iptables -F
iptables -t net -F
iptables -t mangle -F
iptables -X
iptables -t nat -X
iptables -t mangle-X

Then following the guide for CENTOS6/RHEL6 I issued these iptables commands to setup forwarding

iptables -A FORWARD -i eth1 -j ACCEPT
iptables -A FORWARD -o eth1 -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

The confusion begins. I am able to ping from private to public, using a tcp dump I can confirm the IP address is masquerading correctly. However I am also able to ping from public to private.

Here is a dump of linux router's /etc/sysconfig/iptables file

*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A FORWARD -i eth1 -j ACCEPT
-A FORWARD -o eth1 -j ACCEPT
COMMIT
*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT

I've played around with adding rejects, input state related/established. I can't seem to keep the supposedly pubic host from peering into the private network. Any ideas? I'm sure I have something wrong.

Answer 1

Your default policy for the filter table should be DROP, not ACCEPT, else you forward all packets by default.

iptables -P FORWARD DROP

Answer 2

I finally figured it out! First, flush iptables like before:

iptables -F
iptables -t net -F
iptables -t mangle -F
iptables -X
iptables -t nat -X
iptables -t mangle -X

Setup filter policies

iptables -P OUTPUT ACCEPT
iptables -P INPUT ACCEPT
iptables -P FORWARD DROP

Then setup masquerading

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Then setup a filter to prevent routing to your private interface. This keeps public hosts from using the router as a gateway. Without this I can ping the private interface of the router from public.

iptables -A INPUT -i eth1 -j ACCEPT
iptables -A INPUT -j DROP

Finally, setup forwarding

iptables -A FORWARD -i eth1 -j ACCEPT
iptables -A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT