Re: [gentoo-dev] NAT iptables info

[Djamil ESSAISSI <djamil@francexpress.com>]

I fortunatly know what u mean, so i give you as an example my little farm at home ...:
first you have to know: eth0 is hookedup to the DSLmodem
			eth1 is hookedup to the LAN
			ppp0 is the outside link (can be DSL , DIAL UP or even a VPN!)

adsl-start < the stuff of rp-dsl that comes with gentoo...

#Open tha door

route add -net 0.0.0.0 gw 62.4.19.XXX        < the IP on the PPP connection in my case it is static ;).

#Open sesame !

iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE           <  masquerade the bludy LAN thru ppp0
iptables        -A FORWARD     -i eth1 -j ACCEPT		< and do me some forwarding too coming from eth1 [remember eth1 is the LAN side]


#Get me FTP

iptables -t nat -A PREROUTING -p tcp -d 62.4.19.XXX/32 --dport 21 -j DNAT --to 192.168.0.2:21  <<< this is how i use a PIII500/512M as a web 
iptables -t nat -A PREROUTING -p tcp -d 62.4.19.XXX/32 --dport 20 -j DNAT --to 192.168.0.2:20  <<< ftp server behinde a good old p100 .


#Get me HTTP/S

iptables -t nat -A PREROUTING -p tcp -d 62.4.19.XXX/32 --dport 80 -j DNAT --to 192.168.0.2:80   <<<
iptables -t nat -A PREROUTING -p tcp -d 62.4.19.XXX/32 --dport 443 -j DNAT --to 192.168.0.2:443  <<<


#get me ssh

iptables -t nat -A PREROUTING -p tcp -d 62.4.19.XXX/32 --dport 24 -j DNAT --to 192.168.0.2:22 <<< or even use another port to open aonther ssh on the inside machine.


NOTE: there is no firewalling involved here !!! this makes it work only --- it doesnt protect any machine for example: if you got SUB7 on a win98 machine the Lame can get to you machine: but this set up is sweet when i run CS/HL server on an inside machine ...hard to beleive ! it WORKS !

BUT you still can protect it but blocking ports/ips ... good luck and be carefull.
NOTE also that this runs on gentoo so maybe i passed over some steps as they may have been already setup by default ...


grutz.


Djamil-