5

I am new to iptables and I have been doing Google searches for a few days now without finding a good solution to this problem.

I have computer A with a public ip address (say 192.0.2.1) that can access the Internet unrestricted. I have another computer B with a private ip address (192.168.1.1) that can only access computer A. How do I use iptables to forward network traffic from B through A to the Internet? I need to use http, ftp, and https in order to use apt-get with sudo.

Both computers run Ubuntu linux. I have tried using Squid but I think it is far too complicated for what I need to do.

6
  • 1
    I am not an expert on iptables., but it's a firewall, and afaik not a router or switch, so AFAIK it wouldn't say If X then go to this computer. It would say If X then ACCEPT/DROP. Perhaps it may though, there are large features I haven't examined, but.. Is there anything that makes you think it would? – barlop Jun 11 '14 at 14:07
  • I've seen articles like the one below where iptables is doing something similar but not quite the same problem. – ProbablePattern Jun 11 '14 at 14:27
  • Can you give us a diagram or something? How exactly are the two hosts connected? – Zoredache Jun 11 '14 at 15:49
  • @ProbablePattern yeah it looks like iptables might be able to.. There is -j REDIRECT that may just be local.. but there's -j DNAT which is used here askubuntu.com/questions/28516/… – barlop Jun 11 '14 at 16:15
  • Regarding your question, the 'forwarding' from private IP comp to public IP comp that you speak of wouldn't be done by iptables. I think iptables would run on the public IP comp, give it an additional private IP(on another interface) . And the private one would have a route set up to the NAT computer. So that forwarding isn't done by iptables. – barlop Jun 11 '14 at 23:00
3

I think this will do what you want, assuming that the network is like this:
Internet <----> Computer A <----> Computer B

Notes:
<external interface> is the interface (like eth0, p1p1, etc) that is connected to the Internet on Computer A. <internal interface> is the interface on Computer A that is connected to Computer B.

These commands need to be run as root (in su -) on Computer A (the one with Internet access).

EXT=<external interface>
INT=<internal interface>
echo 1 > /proc/sys/net/ipv4/ip_forward #Tell the system it is OK to forward IP packets
iptables -t nat -A POSTROUTING -o $EXT -j MASQUERADE
iptables -A FORWARD -i $EXT -o $INT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i $INT -o $EXT -j ACCEPT
ip addr show $INT

In the output of the ip addr command, find the line that starts with inet (or inet6 if you are using IPv6). Use the IP address on that line in the following command, as root, on Computer B:

ip route add default via <put ComputerA's internal IP address here>

Now, see if it works by running ping google.com on Computer B, or simply by attempting to load a web page in the browser.

If you want to save the changes on Computer A, run these commands as root:

apt-get install iptables-persistent
/etc/init.d/iptables-persistent save

Now I don't know exactly how to restore the saved rules on boot, can anybody else suggest something? It should work to do /etc/init.d/iptables-persistent reload (as root) every time after you boot, but that would be a pain.

To make Computer B always use Computer A as the default gateway would require installing DHCP on Computer A, which I don't want to go into in this answer.

1
  • Thank you works perfectly! The only thing to mention here is to set DNS on computer B as well. – Ahmad Karim Sep 4 '19 at 11:58
1

Now I don't know exactly how to restore the saved rules on boot, can anybody else suggest something? It should work to do /etc/init.d/iptables-persistent reload (as root) every time after you boot, but that would be a pain.

just add the changes in /etc/rc.local or similar

To make Computer B always use Computer A as the default gateway would require installing DHCP on Computer A, which I don't want to go into in this answer.

Set addresses up statically

0

I used squid to do this, it a powerful complicated beast but Squid is really for caching. Then youd be using host1 as a caching proxy host and although you could use that its missing the point. I have done what your trying to do before with IPTABLES (back just after ipchains!). IIRC it involved writing a rule to forward incoming matching packet on to the other route. Lots of info here (if above link hasnt got enuf info).

http://www.linuxtopia.org/Linux_Firewall_iptables/c951.html

I dont beleive using a VPN is a simple solution really, but misses the point of what your trying to do, so id do it the proper way first. VPN is good for encrypting traffic to another host.

0
0

Acting as a gateway between private IP addresses and public IP addresses requires that you do Network Address Translation (NAT). There are plenty of tutorials online about how to use iptables to do NAT, with or without iproute2 (which is another common Linux software package that can do NAT).

-2

Try this

http://www.debuntu.org/how-to-redirecting-network-traffic-to-a-new-ip-using-iptables/

Or use the "simple" way and use an VPN.

1
  • Thanks but that example is different than the question I was asking. I haven't found a VPN setup that is simple. – ProbablePattern Jun 11 '14 at 14:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.