Traffic Forwarder using IPTables

From Leo's Notes
Last edited on 6 July 2020, at 20:27.

To make a Linux host act as the gateway for a NAT using IPTables, there are a few steps to do: 1. Enable IP forwarding in the kernel 2. Create a route so the NAT'ed network is routed via the internal interface 3. Create a NAT on the external interface 4. Allow traffic from the internal interface to forward through to the external interface.

These can be accomplished by running the following:

## Enables forwarding. Same effect with 'sysctl net.ipv4.ip_forward=1'
# echo 1 > /proc/sys/net/ipv4/ip_forward

## Define $INSIDE as the interface going into the NAT
## Define $OUTSIDE as the interface going to the internet

## Route traffic destined to 10.10.2.0/24 to $INSIDE
# route add -net 10.10.2.0/24 dev $INSIDE

## Masquerade traffic going to $OUTSIDE
# iptables -t nat -A POSTROUTING -o $OUTSIDE -j MASQUERADE

## Forward traffic coming from $INSIDE
# iptables -A FORWARD -i $INSIDE -j ACCEPT

Devices on the NAT should use this Linux host as its gateway.

You will probably want to run iptables-save to make the changes persistent after testing.