If I set up a linux box as a router behind a DSL gateway, do I need to enable masquerading or SNAT?
Logically I would assume that all I need to do is enable ip_forwarding (done) but traffic to Internet dies if I don't perform any NATing.
The config is as follows (apologies for diagram)
If NAT is running on the broadband router, then would I also need it running on the ubuntu router?
Below is the config of the ubuntu router iptables...
# Generated by iptables-save v1.4.21 on Thu Oct 29 12:48:19 2015 *nat :PREROUTING ACCEPT [10859:2328892] :INPUT ACCEPT [1002:126271] :OUTPUT ACCEPT [1256:91484] :POSTROUTING ACCEPT [638:43890] COMMIT # Completed on Thu Oct 29 12:48:19 2015 # Generated by iptables-save v1.4.21 on Thu Oct 29 12:48:19 2015 *filter :INPUT ACCEPT [5:803] :FORWARD ACCEPT [127:18532] :OUTPUT ACCEPT [5:431] # INPUT to allow ssh and ping from internal network -A INPUT -i eth1 -p tcp -m tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT -m comment --comment "ssh on eth1" -A INPUT -p icmp -j ACCEPT -m comment --comment "allow ping from internal" -P INPUT DROP # god table to handle traffic forwarding and test icmp -N god -A god -d 126.96.36.199 -j REJECT -A god -d 188.8.131.52 -j DROP # forward configured to explicitly route between interfaces - this could be redundant -A FORWARD -i eth1 -o eth0 -j ACCEPT -A FORWARD -i eth0 -o eth1 -j ACCEPT -A FORWARD -p tcp -j ACCEPT -m comment --comment "all tcp" -A FORWARD -p udp -j ACCEPT -m comment --comment "all udp" -A FORWARD -p icmp -j god -m comment --comment "all icmp" -A FORWARD -i eth0 -j ACCEPT -A FORWARD -i eth1 -j ACCEPT -P FORWARD DROP # output to allow web traffic and icmp from router -A OUTPUT -o eth1 -p tcp -m tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT -A OUTPUT -p udp -m udp --dport 53 -j ACCEPT -A OUTPUT -p tcp -m tcp --dport 53 -j ACCEPT -A OUTPUT -p tcp -m tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT -A OUTPUT -p icmp -j ACCEPT -P OUTPUT DROP COMMIT # Completed on Thu Oct 29 12:48:19 2015
This config keeps killing the Internet, but it always works if I include
-A POSTROUTING -o eth0 -j SNAT --to 192.168.1.1
But why??? Why does this box work only with SNAT, which is not needed because its already in place on the DSL router?
- UPDATED - - - - - - -
As seen in the comments, Radhil and MichaelB are both correct. I am failing to take into account the lack of routing on the broadband router for anything other than one subnet (192.168.1.0 in this instance). Unfortunately this particular broadband router provides no means of adding additional static routes, so my solution for enabling source based routing from the internal subnet in this instance is to use the PREROUTING tables to chain the traffic.
A PREROUTING -i eth1 -m mac --mac-source xx:xx:xx:xx:xx:xx -j DNAT --to 192.168.2.200
-A FORWARD -s 192.168.2.200 -j DROP
This is obviously a lousy solution (done this way as IPTABLES does not allow one to DROP within the PREOUTING / POSTROUTING tables, but I've just included it as an example of being able to route based on source within these straitened circumstances.