how_to_make_a_quick_nat_router_on_ubuntu
no way to compare when less than two revisions
Differences
This shows you the differences between two versions of the page.
— | how_to_make_a_quick_nat_router_on_ubuntu [2010/12/03 23:30] (current) – created tkbletsc | ||
---|---|---|---|
Line 1: | Line 1: | ||
+ | If you've got an Ubuntu box with two NICs and you want a quick NAT router, do the following. This guide assumes that eth0 is your **local network** and eth1 is your **internet connection**. | ||
+ | 1. Remove network manager. | ||
+ | |||
+ | $ sudo apt-get remove network-manager | ||
+ | |||
+ | 2. Configure both NICs. Set the internet NIC (eth1 below) to automatic DHCP mode, and the local NIC (eth0 below) to a static IP of 192.168.0.1 with netmask 255.255.255.0. To do this, you can either (a) use the GUI in System | Admin | Network, or (b) as root, edit / | ||
+ | |||
+ | < | ||
+ | auto lo | ||
+ | iface lo inet loopback | ||
+ | |||
+ | # internet | ||
+ | auto eth1 | ||
+ | iface eth1 inet dhcp | ||
+ | pre-up iptables-restore < / | ||
+ | pre-up echo 1 > / | ||
+ | |||
+ | # local | ||
+ | iface eth0 inet static | ||
+ | address 192.168.0.1 | ||
+ | netmask 255.255.255.0 | ||
+ | auto eth0 | ||
+ | </ | ||
+ | |||
+ | 3. If you used the GUI in step 2, you'll need to edit / | ||
+ | |||
+ | pre-up iptables-restore < / | ||
+ | pre-up echo 1 > / | ||
+ | |||
+ | Either way, your completed file should look like the example in step 2. | ||
+ | |||
+ | 4. Put the following rules into / | ||
+ | |||
+ | < | ||
+ | # | ||
+ | # | ||
+ | # NAT with eth1=remote and eth0=local, adapted from: | ||
+ | # | ||
+ | # specifically, | ||
+ | # | ||
+ | # | ||
+ | *filter | ||
+ | :FORWARD DROP [0:0] | ||
+ | :INPUT DROP [0:0] | ||
+ | :OUTPUT ACCEPT [0:0] | ||
+ | -A FORWARD -m state --state RELATED, | ||
+ | -A FORWARD -i eth0 -j ACCEPT | ||
+ | # (1/2) To forward a port, you need to add TWO lines. | ||
+ | # -A FORWARD -p tcp --dport < | ||
+ | -A INPUT -m state --state RELATED, | ||
+ | -A INPUT -i lo -j ACCEPT | ||
+ | # To accept a port on the router, add a line like: | ||
+ | # -A INPUT -p tcp --dport 25 -j ACCEPT | ||
+ | # To open ALL ports: | ||
+ | # -A INPUT -j ACCEPT | ||
+ | -A INPUT -j ACCEPT | ||
+ | COMMIT | ||
+ | *nat | ||
+ | :PREROUTING ACCEPT [0:0] | ||
+ | : | ||
+ | :OUTPUT ACCEPT [0:0] | ||
+ | # (2/2) To forward a port, you need to add TWO lines. | ||
+ | # -A PREROUTING -i eth1 -p tcp --dport < | ||
+ | -A POSTROUTING -o eth1 -j MASQUERADE | ||
+ | COMMIT | ||
+ | </ | ||
+ | |||
+ | The comments tell you how to add port forwarding. | ||
+ | |||
+ | Steps 1-5 take care of enabling NAT routing itself. | ||
+ | |||
+ | 5. Install dhcp3-server: | ||
+ | |||
+ | $ sudo apt-get install dhcp3-server | ||
+ | |||
+ | 6. Add our NAT subnet to the config file "''/ | ||
+ | |||
+ | < | ||
+ | subnet 192.168.0.0 netmask 255.255.255.0 { | ||
+ | range 192.168.0.100 192.168.0.200; | ||
+ | option routers 192.168.0.1; | ||
+ | option domain-name-servers 152.1.1.248, | ||
+ | } | ||
+ | </ | ||
+ | |||
+ | 7. Restart the DHCP server: | ||
+ | |||
+ | $ sudo / | ||
+ | |||
+ | 8. Make sure it started okay by checking the syslog: | ||
+ | |||
+ | $ less / | ||
+ | |||
+ | You should see something like: | ||
+ | < | ||
+ | May 16 13:26:42 if dhcpd: Internet Systems Consortium DHCP Server V3.0.6 | ||
+ | May 16 13:26:42 if dhcpd: Copyright 2004-2007 Internet Systems Consortium. | ||
+ | May 16 13:26:42 if dhcpd: All rights reserved. | ||
+ | May 16 13:26:42 if dhcpd: For info, please visit http:// | ||
+ | May 16 13:26:42 if dhcpd: Wrote 0 leases to leases file. | ||
+ | May 16 13:26:42 if dhcpd: | ||
+ | May 16 13:26:42 if dhcpd: No subnet declaration for eth1 (152.14.92.129). | ||
+ | May 16 13:26:42 if dhcpd: ** Ignoring requests on eth1. If this is not what | ||
+ | May 16 13:26:42 if dhcpd: | ||
+ | May 16 13:26:42 if dhcpd: | ||
+ | May 16 13:26:42 if dhcpd: | ||
+ | May 16 13:26:42 if dhcpd: | ||
+ | </ | ||
+ | |||
+ | That error about "No subnet declaration for eth1" is good -- we don't **want** to do DHCP server on our internet uplink! | ||
+ | |||
+ | 9. Connect a machine to the LAN side and boot it up. It should get an IP and be able to access the internet. |
how_to_make_a_quick_nat_router_on_ubuntu.txt · Last modified: 2010/12/03 23:30 by tkbletsc