Title: iptables and NAT (Network Address Translation)
Course: CIS 208: Linux/UNIX III: Intermediate System Administration, Networking, and Security ~ For IGNITE Review > Section: Learning Modules

iptables and NAT

The iptables command allows advanced configuration of network settings.  Most often it is used to provide a firewall for one or more network interfaces.  However it is very capable at mangling packets, which can allow Network Address Translation (NAT) to convert IP addresses.

The functionality of iptables is built into the kernel using the netfilter modules.  This means that it runs within the OS and does not run in a separate process.  The iptables is used to manually update the rules, or configuration tools can be used.

Unless there is a good reason to manually adjust the rules, it is better to use the tools that come with distribution to manage iptables.  Distributions based on Red Hat use the system-config-firewall and system-config-firewall-tui to provide an intuitive method to configure the firewall and NAT services.  They also provide lokkit to manage the firewall from the command line.

Each interface should be filtered, except for the loopback device (lo) and perhaps internal network interfaces.  By default the only allowed incoming connections are on ssh (port 22:tcp).  Notice that outgoing connections are allowed, as well as established or related connections.  When configuring the firewall, only allow the ports for services that are needed. For example:

- A webserver will need port 80:tcp.
- A dns server will need 53:tcp and 53:udp.

To review the current rules, run "iptables -nL".  The "-n" option means to show numbers instead of names (for hosts and services) and the "-L" option means to list the rules.

Here is sample output when the iptables service is turned off:

[carl@hal ~]# iptables -nL
Chain INPUT (policy ACCEPT)
target        prot opt source                destination

Chain FORWARD (policy ACCEPT)
target        prot opt source                destination

Chain OUTPUT (policy ACCEPT)
target        prot opt source                destination

Here is a sample with the default rules:

[carl@hal ~]# iptables -nL

Chain INPUT (policy ACCEPT)
traget        prot opt source                destination
ACCEPT      all  -  0.0.0.0/0              0.0.0.0/0        state
RELATED,ESTABLISHED
ACCEPT     icmp -  0.0.0.0/0             0.0.0.0/0
ACCEPT     all    -   0.0.0.0/0             0.0.0.0/0
ACCEPT     icp   -   0.0.0.0/0             0.0.0.0/0        state NEW tcp
dpt:22
REJECT     all   -    0.0.0.0/0             0.0.0.0/0        reject-with icmp-
host-prohibited

Chain FORWARD (policy ACCEPT)
target        prot opt source                destination
REJECT      all  -  0.0.0.0/0               0.0.0.0/0        reject-with icmp-
host-prohibited

Chain OUTPUT (policy ACCEPT)

target        prot opt source                destination
#

Network Address Translation (NAT) allows a single host to work like a proxy server providing Internet connections to a network with unrouteable IP addresses.  The host needs to have a network interface that connects to the Internet and another that connects to the local network.  The host will then rewrite packets originating on the local network, translating the source IP address to its own external IP address.  When a response comes back, the host refers to an internal connection table to know what local IP address will be the new destination for the response packets.

To use NAT,

1. Verify that the dual homed host can connect to the Internet.
2. Run system-config-firewall-tui and check the appropriate interface to be masqueraded.
3. If needed, edit or add a line to /etc/sysctl.conf to allow ip forwarding:  "net.ipv4.ip_forward = 1".
4. Then run "sysctl -p".
5. Next configure the remaining hosts on the local network to use the dual homed host as their gateway.