Postrouting chain helps to translate the source IP address of the packets to something that might match the routing on the destination server. More DNAT rules, similar to the above, can be added, for example, to reach an HTTP webserver on port 8080 which is hosted on 10.8.8.44:80: # iptables -t nat -A PREROUTING -i eth0 -p tcp -dport 8080 -j DNAT -to-destination 10.8.8.44:80 Now, if we try to initialise an SSH connection from the outside (eth0) network to 10.10.1.20:22043, we should be able to access the 10.8.8.43 machine on port 22. In the following example, we want to forward all SSH traffic on port 22043 to 10.8.8.43 machine’s local port 22: # iptables -t nat -A PREROUTING -i eth0 -p tcp -dport 22043 -m comment -comment "DNAT SSH for. Prerouting chain helps to translate the destination IP address of the packets to something that matches the routing on the local server. A FORWARD -p tcp -j DROP Configure NAT Table: Prerouting Chain A FORWARD -p tcp -j LOG -log-prefix "iptables_forward " A FORWARD -p tcp -m state -state RELATED,ESTABLISHED -j ACCEPT A FORWARD -d 10.8.8.0/24 -i eth0 -o eth1 -p tcp -m multiport -dports 22 -m state -state NEW -j ACCEPT A FORWARD -d 10.8.8.0/24 -i eth0 -o eth1 -p tcp -m multiport -dports 80,443 -m state -state NEW -j ACCEPT A FORWARD -s 10.8.8.0/24 -i eth1 -o eth0 -p tcp -m multiport -dports 80,443 -m state -state NEW -j ACCEPT A FORWARD -i eth1 -o eth0 -p icmp -m state -state NEW -j ACCEPT Here’s the final iptables configuration for the filter table forward chain: # iptables -S FORWARD Lastly, we are to log everything else for troubleshoting purposes before dropping: # iptables -A FORWARD -p tcp -j LOG -log-prefix "iptables_forward " Then, we want to allow all already established or related connections, both ways: # iptables -A FORWARD -p tcp -m state -state RELATED,ESTABLISHED -j ACCEPT We also want to be able to connect to the private (eth1) network via SSH: # iptables -A FORWARD -d 10.8.8.0/24 -i eth0 -o eth1 -p tcp -m multiport -dports 22 -m state -state NEW -j ACCEPT On the other hand, if we are going to host some private webservers ourselves, we want the ability to reach them from the public (eth0) network: # iptables -A FORWARD -d 10.8.8.0/24 -i eth0 -o eth1 -p tcp -m multiport -dports 80,443 -m state -state NEW -j ACCEPT Note that the source network address definition is not mandatory here. We also want the servers on the internal (eth1) network to able to initiate connections to public webservers on both HTTP and HTTPS ports: # iptables -A FORWARD -s 10.8.8.0/24 -i eth1 -o eth0 -p tcp -m multiport -dports 80,443 -m state -state NEW -j ACCEPT Therefore we need to allow all new ICMP traffic, originated from eth1, to leave via eth0: # iptables -A FORWARD -i eth1 -o eth0 -p icmp -m state -state NEW -j ACCEPT We want the machines on the internal network (eth1) to be able to ping public servers. Enable ForwardingĮnable IP forwarding on the CentOS server: # sed -i 's/_forward = 0/_forward = 1/' /etc/nfġ0.10.1.0/24 dev eth0 proto kernel scope link src 10.10.1.20ġ0.8.8.0/24 dev eth1 proto kernel scope link src 10.8.8.2ĭefault gateway is on a “public” eth0 interface. The image below may help to understand the network configuration.Ĭheck Linux home lab environment with VirtualBox for more info.
0 kommentar(er)
