2012年08月31日 sample for setting to do NAPT(IP MASQUERADE) by iptables [長年日記]
_ iptables's chain
[Recieved packet] -> [PREROUTING] -> [FORWARD] -> [POSTROUTING] -> [Sending packet]
| ^
V |
[INPUT] [OUTPUT]
| ^
V |
[ (recieve) Local process (send) ]
_ iptables's command sequence
- eth0 : Global network
- eth1 : Private network
/usr/sbin/iptables -F # Flush `filter table' /usr/sbin/iptables -t nat -F # Flush `nat table' # /usr/sbin/iptables -P OUTPUT ACCEPT # Set policy for OUTPUT /usr/sbin/iptables -P FORWARD DROP # Set policy for FORWARD /usr/sbin/iptables -P INPUT DROP # Set policy for INPUT # /usr/sbin/iptables -A FORWARD -p udp -i eth1 -o eth0 -s 192.168.0.?? -j ACCEPT # Accept UDP from eth1 to eth0 /usr/sbin/iptables -A FORWARD -p tcp -i eth1 -o eth0 -s 192.168.0.?? -j ACCEPT # Accept TCP from eth1 to eth0 # /usr/sbin/iptables -A FORWARD -i eth0 -o eth1 -d 192.168.0.?? -m state --state ESTABLISHED,RELATED -j ACCEPT # Accept all established packet from eth0 to eth1 # /usr/sbin/iptables -t nat -A POSTROUTING -o eth0 -s 192.168.0.?? -j MASQUERADE # NAPT for out going from eth0 # /bin/echo 1 >/proc/sys/net/ipv4/ip_forward # Enable IP forward # /usr/sbin/iptables -A INPUT -p all -i eth0 -j DROP # Drop all unknown packet
[ツッコミを入れる]