5

I try to set up SNAT with firewalld on my CentOS-7-Router like described here, with additions from Karl Rupps explanation, but I end up like Eric. I also read some other documentation, but I am not able to get it to work, so that my client-IP is translated into another source IP.

Both

firewall-cmd --permanent --direct --add-rule ipv4 nat POSTROUTING 0 -p tcp -o enp1s0 -d 192.168.15.105 -j SNAT --to-source 192.168.25.121

or

firewall-cmd --permanent --direct --add-rule ipv4 nat POSTROUTING 0 -p tcp -s 192.168.15.105/32 -j SNAT --to-source 192.168.25.121

gives a "success". I do a firewall-cmd --reload afterwards. But if I try to examine the table with iptables -t nat -nvL POSTROUTING the rule is not listed.

But if I apply one of the above rules again, firewalld warns me with e.g. Warning: ALREADY_ENABLED: rule '['-p', 'tcp', '-o', 'enp1s0', '-d', '192.168.15.105', '-j', 'SNAT', '--to-source', '192.168.25.121']' already is in 'ipv4:nat:POSTROUTING'- but no SNAT-functionality for the source-ip 192.168.15.105 to be masqueraded as 192.168.45.121 is working.

Maybe someone can explain me what I am doing wrong?


After hours of struggling, I still am hanging on DNAT/SNAT. I now use only iptables with:

1.) iptables -t nat -A PREROUTING -p tcp --dport 1433 -i enp1s0 -d 192.168.25.121 -j DNAT --to-destination 192.168.15.105

and

2.) iptables -t nat -A POSTROUTING -p tcp --sport 1433 -o enp1s0 -s 192.168.15.105/32 -j SNAT --to-source 192.168.25.121

so iptables -t nat -nvL PREROUTING shows:

pkts bytes target     prot opt in     out     source               destination         
129 12089 PREROUTING_direct  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
129 12089 PREROUTING_ZONES_SOURCE  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
129 12089 PREROUTING_ZONES  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
0     0 DNAT       tcp  --  enp1s0 *       0.0.0.0/0            192.168.25.121       tcp dpt:1433 to:192.168.15.105

and

iptables -t nat -nvL POSTROUTING shows:

 pkts bytes target     prot opt in     out     source               destination         
   97  7442 POSTROUTING_direct  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
   97  7442 POSTROUTING_ZONES_SOURCE  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
   97  7442 POSTROUTING_ZONES  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 SNAT       tcp  --  *      enp1s0  192.168.15.105       0.0.0.0/0            tcp spt:1433 to:192.168.25.121

All done right, here are some more good explanations:
- https://wiki.ubuntuusers.de/iptables2
- https://netfilter.org/documentation/HOWTO/NAT-HOWTO-6.html
- https://serverfault.com/questions/667731/centos-7-firewalld-remove-direct-rule

but still iptraf-ng lists: enter image description here

Isn't PREROUTING (resp. POSTROUTING) done before (resp. after) ip_forwarding from internal to external interface?

2 Answers 2

6
#!/bin/bash
# Assuming that your Linux box has two NICs; eth0 attached to WAN and eth1 attached to LAN
# eth0 = outside
# eth1 = inside
# [LAN]----> eth1[GATEWAY]eth0 ---->WAN
# Run the following commands on LINUX box that will act as a firewall or NAT gateway
firewall-cmd --query-interface=eth0
firewall-cmd --query-interface=eth1
firewall-cmd --get-active-zone 
firewall-cmd --add-interface=eth0 --zone=external
firewall-cmd --add-interface=eth1 --zone=internal
firewall-cmd --zone=external --add-masquerade --permanent 
firewall-cmd --reload 
firewall-cmd --zone=external --query-masquerade 
# ip_forward is activated automatically if masquerading is enabled.
# To verify:
cat /proc/sys/net/ipv4/ip_forward 
# set masquerading to internal zone
firewall-cmd --zone=internal --add-masquerade --permanent
firewall-cmd --reload 
firewall-cmd --direct --add-rule ipv4 nat POSTROUTING 0 -o eth0 -j MASQUERADE
firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i eth0 -o eth1 -j ACCEPT
firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
firewall-cmd --reload
1
  • Oh mean! This works! Great! Iptables is the only really covered topic in the internet! Thanks May 15, 2020 at 16:36
1

There is a similar answer here:

https://www.server-world.info/en/note?os=CentOS_7&p=firewalld&f=2

That uses nmcli to set internal/external:

nmcli c mod ens224 connection.zone internal
nmcli c mod ens192 connection.zone external

but @Bruce Malaudzi 's answer is more informative. I'm not used to firewalld yet so I started out with the default/iptables advice: How can I use Linux as a Gateway? The firewalld default setup uses IP Chain differently, so its better to go all the way with firewalld.

Thanks for the iptraf-ng preview @jochen-gebsattel that's a great little program.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.