Iptables: Explanations, options & examples - Revision history

David: /* Enable NAT/Masquerading on a new system */

2015-01-21T15:17:02Z

Enable NAT/Masquerading on a new system

2015-01-21T14:30:18Z

Enable NAT/Masquerading on a new system

2014-08-04T14:31:12Z

Saving and restoring an iptables config in ubuntu

2014-08-04T14:30:50Z

Saving and restoring an iptables config in ubuntu

2014-08-04T14:28:52Z

2012-11-16T10:19:48Z

Explanation of an example iptables rule

2012-11-16T10:04:49Z

Enable NAT/Masquerading on a new system

2012-11-16T10:03:57Z

Enable NAT/Masquerading on a new system

2012-11-16T10:02:20Z

Practical examples

2012-11-16T09:59:51Z

@@ Line 135: / Line 135: @@
 [root@srv1 ~]# iptables -A FORWARD -i eth1 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
 [root@srv1 ~]# iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT
 </syntaxhighlight>
 To commit these new rules to the '''<code>/etc/sysconfig/iptables</code>''' configuration file, type:

@@ Line 124: / Line 124: @@
 == Practical examples ==
 === Enable NAT/Masquerading on a new system ===
-Firstly, the Linux kernel needs to be told to entertain IP forwarding;
+* Useful for setting up a node as a gateway within centos or RHEL
 <syntaxhighlight>
 [root@srv1 ~]# echo 1 > /proc/sys/net/ipv4/ip_forward

@@ Line 141: / Line 141: @@
 == Saving and restoring an iptables config in ubuntu ==
-Unlike RedHat based distros, ubuntu does not, by default, save the iptables config to a text file and the <code>service iptables save</code> option is not available so any changes will, without and further action, be lost in the event of a system reboot.
+Unlike RedHat based distros, ubuntu does not, by default, save the iptables config to a text file and the <code>service iptables save</code> option is not available so any changes will, without further action, be lost in the event of a system reboot.
 <br><br>
 Settings can be saved and restored by using the '''<code>iptables-save</code>''' and '''<code>iptables-restore</code>''' commands.

@@ Line 141: / Line 141: @@
 == Saving and restoring an iptables config in ubuntu ==
-Unlike RedHat based distros, ubuntu do not, by default, save the iptables config to a text file and the <code>service iptables save</code> option is not available so any changes will, without and further action, be lost in the event of a system reboot. There is a way around this.
+Unlike RedHat based distros, ubuntu does not, by default, save the iptables config to a text file and the <code>service iptables save</code> option is not available so any changes will, without and further action, be lost in the event of a system reboot.
 === Save iptables config to a file ===

@@ Line 138: / Line 138: @@
 <syntaxhighlight>
 [root@srv1 ~]# service iptables save
 </syntaxhighlight>

@@ Line 59: / Line 59: @@
 * <code>-m udp</code> = '''match''' = '''UDP''' - ''not sure what this means!''
 * <code>--dport 53</code> = '''desintation port''' = '''53'''
-* <code>-j ACCEPT</code> = '''Jump''' to the target of '''ACCEPT'''. Basically, what to do if the packet matches the rule criteria. Option could be to ACCEPT, DENY or jump to another chain.
+* <code>-j ACCEPT</code> = '''Jump''' to the target of '''ACCEPT'''. Basically, what to do if the packet matches the rule criteria. Option could be to ACCEPT, DENY, jump to another chain or a number of different possibilities.
 This rule will basically '''accept''' '''UDP''' traffic on '''port 53''' across '''virbr0'''. In practice, this rule will exist in the <code>*filter</code> ''table'' and will allow DNS operations over the KVM virtual network interface known as <code>virbr0</code>.

← Older revision		Revision as of 10:02, 16 November 2012
Line 129:		Line 129:
	</syntaxhighlight>		</syntaxhighlight>
	Or for a permanent solution, edit '''<code>/etc/sysctl.conf</code>''' and change the line that says '''<code>net.ipv4.ip_forward = 0</code>''' to '''<code>net.ipv4.ip_forward = 1</code>'''.		Or for a permanent solution, edit '''<code>/etc/sysctl.conf</code>''' and change the line that says '''<code>net.ipv4.ip_forward = 0</code>''' to '''<code>net.ipv4.ip_forward = 1</code>'''.
		+	<br>Then:
		+	<syntaxhighlight>
		+	[root@srv1 ~]# iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
		+	[root@srv1 ~]# iptables -A FORWARD -i eth1 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
		+	[root@srv1 ~]# iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT
		+	</syntaxhighlight>

← Older revision		Revision as of 09:59, 16 November 2012
Line 121:		Line 121:
	[root@srv1 ~]# iptables -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535		[root@srv1 ~]# iptables -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535
	</syntaxhighlight>		</syntaxhighlight>
		+
		+	== Practical examples ==
		+	=== Enable NAT/Masquerading on a new system ===
		+	Firstly, the Linux kernel needs to be told to entertain IP forwarding;
		+	<syntaxhighlight>
		+	[root@srv1 ~]# echo 1 > /proc/sys/net/ipv4/ip_forward
		+	</syntaxhighlight>
		+	Or for a permanent solution, edit '''<code>/etc/sysctl.conf</code>''' and change the line that says '''<code>net.ipv4.ip_forward = 0</code>''' to '''<code>net.ipv4.ip_forward = 1</code>'''.