Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am trying to make an iptables gateway. I ordered 3 dedicated server from my hosting company all with dual nics. One server has been given all the ip addresses and is connected directly to the internet and has its other nic connected to a switch where the other servers are all connected also. I want to setup iptables so for example the ip address 50.0.2.4 comes into my gateway server it fowards all the traffic to a private ip address using the second nic. This way the second nic can do what ever it needs and can respond back also. I also want it setup that if any of the other servers needs to download anything over the inernet it is able to do so and by using the same ip address that is used for its incomming traffic.

Lastly I would like to be able to setup dns and other needed networking stuff that i maybe not thinking about.

share|improve this question
    
Are you just thinking out loud? –  Snesticle Nov 4 '12 at 3:25
    
No i dont know how to do that with ip tables at all. –  WojonsTech Nov 4 '12 at 6:00

1 Answer 1

up vote 1 down vote accepted

I use firewall builder to put together a template iptables with NAT for you.

Gateway machine

  • External Interface: eth0 (IP:50.0.2.4)
  • Internal Interface: eth1 (IP:192.168.1.1

  • Services forward to 192.168.1.10: imap, imaps, pop, pops, smtp, smtps

  • Services forward to 192.168.1.20: http, https

Internal machine 1

  • Interface: eth0 (IP:192.168.1.10)

Internal machine 2

  • Interface: eth0 (IP:192.168.1.20)
    IPTABLES="/sbin/iptables"

    # ================ Table 'filter', automatic rules
    # accept established sessions
    $IPTABLES -A INPUT   -m state --state ESTABLISHED,RELATED -j ACCEPT 
    $IPTABLES -A OUTPUT  -m state --state ESTABLISHED,RELATED -j ACCEPT 
    $IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT


    # ================ Table 'nat',  rule set NAT
    # 
    # Rule 0 (NAT)
    # 
    echo "Rule 0 (NAT)"
    # 
    $IPTABLES -t nat -A PREROUTING -p tcp -m tcp -m multiport   -d 50.0.2.4  --dports 143,993,110,995,25,465 -j DNAT --to-destination 192.168.1.10
    # 
    # Rule 1 (NAT)
    # 
    echo "Rule 1 (NAT)"
    # 
    $IPTABLES -t nat -A PREROUTING -p tcp -m tcp -m multiport   -d 50.0.2.4  --dports 80,443 -j DNAT --to-destination 192.168.1.20
    # 
    # Rule 2 (NAT)
    # 
    echo "Rule 2 (NAT)"
    # 
    $IPTABLES -t nat -A POSTROUTING -o eth0   -s 192.168.1.0/24  -j SNAT --to-source 50.0.2.4



    # ================ Table 'filter', rule set Policy
    # 
    # Rule 0 (eth0)
    # 
    echo "Rule 0 (eth0)"
    # 
    # anti spoofing rule
    $IPTABLES -N In_RULE_0
    $IPTABLES -A INPUT -i eth0   -s 50.0.2.4   -j In_RULE_0
    $IPTABLES -A INPUT -i eth0   -s 192.168.1.1   -j In_RULE_0
    $IPTABLES -A INPUT -i eth0   -s 192.168.1.0/24   -j In_RULE_0
    $IPTABLES -A FORWARD -i eth0   -s 50.0.2.4   -j In_RULE_0
    $IPTABLES -A FORWARD -i eth0   -s 192.168.1.1   -j In_RULE_0
    $IPTABLES -A FORWARD -i eth0   -s 192.168.1.0/24   -j In_RULE_0
    $IPTABLES -A In_RULE_0  -j LOG  --log-level info --log-prefix "RULE 0 -- DENY "
    $IPTABLES -A In_RULE_0  -j DROP
    # 
    # Rule 1 (lo)
    # 
    echo "Rule 1 (lo)"
    # 
    $IPTABLES -A INPUT -i lo   -m state --state NEW  -j ACCEPT
    $IPTABLES -A OUTPUT -o lo   -m state --state NEW  -j ACCEPT
    # 
    # Rule 2 (global)
    # 
    echo "Rule 2 (global)"
    # 
    # SSH Access to firewall is permitted
    $IPTABLES -N Cid4216X2697.0
    $IPTABLES -A OUTPUT -p tcp -m tcp  -m multiport  --dports 80,443,143,993,110,995,25,465,22  -m state --state NEW  -j Cid4216X2697.0
    $IPTABLES -A Cid4216X2697.0  -d 50.0.2.4   -j ACCEPT
    $IPTABLES -A Cid4216X2697.0  -d 192.168.1.1   -j ACCEPT
    $IPTABLES -A INPUT -p tcp -m tcp  -m multiport  --dports 80,443,143,993,110,995,25,465,22  -m state --state NEW  -j ACCEPT
    # 
    # Rule 3 (global)
    # 
    echo "Rule 3 (global)"
    # 
    # Firewall can connect to anything
    $IPTABLES -A INPUT  -s 50.0.2.4   -m state --state NEW  -j ACCEPT
    $IPTABLES -A INPUT  -s 192.168.1.1   -m state --state NEW  -j ACCEPT
    $IPTABLES -A OUTPUT  -m state --state NEW  -j ACCEPT
    # 
    # Rule 4 (global)
    # 
    echo "Rule 4 (global)"
    # 
    # All other attempts to connect to
    # the firewall are denied and logged
    $IPTABLES -N RULE_4
    $IPTABLES -A OUTPUT  -d 50.0.2.4   -j RULE_4
    $IPTABLES -A OUTPUT  -d 192.168.1.1   -j RULE_4
    $IPTABLES -A INPUT  -j RULE_4
    $IPTABLES -A RULE_4  -j LOG  --log-level info --log-prefix "RULE 4 -- DENY "
    $IPTABLES -A RULE_4  -j DROP
    # 
    # Rule 5 (global)
    # 
    echo "Rule 5 (global)"
    # 
    $IPTABLES -A INPUT  -s 192.168.1.0/24   -m state --state NEW  -j ACCEPT
    $IPTABLES -A OUTPUT  -s 192.168.1.0/24   -m state --state NEW  -j ACCEPT
    $IPTABLES -A FORWARD  -s 192.168.1.0/24   -m state --state NEW  -j ACCEPT
    # 
    # Rule 6 (global)
    # 
    echo "Rule 6 (global)"
    # 
    $IPTABLES -N RULE_6
    $IPTABLES -A OUTPUT  -j RULE_6
    $IPTABLES -A INPUT  -j RULE_6
    $IPTABLES -A FORWARD  -j RULE_6
    $IPTABLES -A RULE_6  -j LOG  --log-level info --log-prefix "RULE 6 -- DENY "
    $IPTABLES -A RULE_6  -j DROP

    echo 1 > /proc/sys/net/ipv4/ip_forward
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.