User guide

Chapter 2. Securing Your Network

To allow LAN nodes with private IP addresses to communicate with external public networks, configure

the firewall for IP masquerading, which masks requests from LAN nodes with the IP address of the

firewall's external device (in this case, eth0):

[root@myServer ~ ] # iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

This rule uses the NAT packet matching table (-t nat) and specifies the built-in POSTROUTING

chain for NAT (-A POSTROUTING) on the firewall's external networking device (-o eth0).

POSTROUTING allows packets to be altered as they are leaving the firewall's external device.

The -j MASQUERADE target is specified to mask the private IP address of a node with the external IP

address of the firewall/gateway.

2.5.5.2. Prerouting

If you have a server on your internal network that you want make available externally, you can use the

-j DNAT target of the PREROUTING chain in NAT to specify a destination IP address and port where

incoming packets requesting a connection to your internal service can be forwarded.

For example, if you want to forward incoming HTTP requests to your dedicated Apache HTTP Server

at 172.31.0.23, use the following command:

[root@myServer ~ ] # iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to

172.31.0.23:80

This rule specifies that the nat table use the built-in PREROUTING chain to forward incoming HTTP

requests exclusively to the listed destination IP address of 172.31.0.23.

Note

If you have a default policy of DROP in your FORWARD chain, you must append a rule to forward

all incoming HTTP requests so that destination NAT routing is possible. To do this, use the

following command:

[root@myServer ~ ] # iptables -A FORWARD -i eth0 -p tcp --dport 80 -d 172.31.0.23 -j

This rule forwards all incoming HTTP requests from the firewall to the intended destination; the

Apache HTTP Server behind the firewall.

2.5.5.3. DMZs and IPTables

You can create iptables rules to route traffic to certain machines, such as a dedicated HTTP or FTP

server, in a demilitarized zone (DMZ). A DMZ is a special local subnetwork dedicated to providing

services on a public carrier, such as the Internet.

For example, to set a rule for routing incoming HTTP requests to a dedicated HTTP server at 10.0.4.2

(outside of the 192.168.1.0/24 range of the LAN), NAT uses the PREROUTING table to forward the

packets to the appropriate destination:

[root@myServer ~ ] # iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-

destination 10.0.4.2:80