Re: [gentoo-dev] Fast NAT-Solution

[Martin Schlemmer]

On Mon, 2001-10-01 at 18:31, Sebastian Werner wrote:
> Hey gentoo-developer,
>
> is there anybody who has worked some time with iptables. I need a
> solution to get a network in the internet. I have read some material
> about security and so on, but there is not so much about NAT. I want
> that all ports (http, https, ftp, pop3, smtp) and all requests go to all
> the network-clients. I don't want to study a more than 100 page book for
> this smart solution (under windows I must only activate internet
> connection sharing - I want this for linux)
>
> Ok I am a bad guy, please help me if you have a minute to much today,
>
> Thanks,
>
> Sebastian
> sebastian@××××××××××××××××××.de
> http://www.werner-productions.de
>
>
>

Hi

This is a simple example from Rusty's packet-filtering-HOWTO.
It uses simple statefull filtering (related connections is allowed back
in, but no NEW connections is allowed in).

------------cut here------------------------------------
#!/bin/bash

# Load the required modules if modular kernel is used
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_conntrack
/sbin/modprobe ip_tables

# Masquerade out ppp0
/sbin/iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE

# Disallow NEW and INVALID incoming or forwarded 
# packets from ppp0.
/usr/sbin/iptables -A INPUT -i ppp0 -m state \
	--state NEW,INVALID -j DROP
/usr/sbin/iptables -A FORWARD -i ppp0 -m state \
	--state NEW,INVALID -j DROP

# Turn on IP forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward
---------cut here---------------------------------------------

Hope it is of some help.


Greetings,
  MS
-- 

Martin Schlemmer
Gentoo Linux Developer, Desktop Team Developer
Cape Town, South Africa
Town, South Africa