In: Categories » Computers and technology » Linux » SNAT with iptables
So far, we discussed general NAT principles, NAT types, and what every sort of NAT does.
netfilter/iptables can be used to perform NAT in any of the ways that we discussed. Actually, there are many things that you can do with iptables in this area and we will try to cover as much as possible in this article. Before we get there, let's see what we need to be able to successfully perform NAT on Linux.
Setting Up the Kernel
Usually, every Linux distribution comes with a kernel compiled with netfilter support, iptables tool, and all the modules needed for performing Network Address Translation.
A very good HowTo on compiling Linux 2.4 and 2.6 kernels is written by Kwan Lowe and can be found at http://www.digitalhermit.com/linux/Kernel-Build-HOWTO.html
When compiling a new kernel or recompiling the kernel that you have, you must set NETFILTER=y in order to use iptables. In the 2.6 kernels, this option is usually found under Device Drivers | Networking support | Networking support (NET [=y]) | Networking options, but it really depends on the kernel version.
For example, in kernel 2.6.14, this option is found under Networking | Networking Options.
If you use make menuconfig or make xconfig to configure your kernel for recompiling, select Networking | Networking options | Network packet filtering (replaces ipchains) | IP: Netfilter Configuration.
In the IP: Netfilter Configuration section you will find the options needed for NAT as follows:
IP_NF_CONNTRACK or Connection tracking (required for masq/NAT) keeps a record of the IP packets that passed through the machine in order to pass them correctly to the NATed endpoints when requests made from those are answered. This is vital for NAT. If you say No here, you will not be able to perform NAT.
The netfilter nat Table
The nat table contains three chains—PREROUTING, POSTROUTING, and OUTPUT. Each chain may contain rules that are examined sequentially until one of the rules matches a packet, the same as for the chains in the netfilter table. These chains can be viewed by issuing the command iptables –t nat –L.
the modules iptable_nat and ip_conntrack when issuing any commands with iptables –t nat; so there is no need to use Linux utilities insmod or modprobe for NAT to work.
The OUTPUT chain is not fully supported, so we will have to ignore that for now.
The PREROUTING and POSTROUTING chains have meaningful names. The PREROUTING chain is analyzed by the kernel before any routing decision is made. Therefore, what we should do in the PREROUTING chain is to change the address of the destination IP and then leave it to the routing process to find the destination that we just changed (DNAT).
The POSTROUTING chain contains rules that the kernel analyzes after a routing decision is made. This means that we have a path to the destination, and so we can change the source IP address if that path is outside our network (SNAT).
SNAT with iptables
SNAT is one of the most commonly used types of NAT with iptables because of the topology used.
Let's see, for example, the following scenario:
Network 192.168.1.0/24 is in our office. We have an Ethernet connection from our provider, which assigned us the IP address 1.2.3.1/30 and the default gateway 1.2.3.2.
All the computers in the 192.168.1.0/24 network have the default gateway set to 192.168.1.1.
Our Linux router has two Ethernet interfaces:
- Eth0, with the IP address 192.168.1.1 and netmask 255.255.255.0, is connected to a switch that connects other devices in the 192.168.1.0/24 network.
- Eth1, with the IP address 1.2.3.1 and netmask 255.255.255.252, is connected to the provider's CPE (Customer Premises Equipment), which can be a DSL modem, cable modem, media converter, etc.
We can set up SNAT so that all devices in the 192.168.1.0/24 network access the Internet with only one rule:
iptables –t nat –A POSTROUTING –s 192.168.1.0/24 –j SNAT –-to 1.2.3.1
This command has the same effect as the following command, which we would use if the IP address of Eth1 were dynamically assigned, or if we used a dial-up modem instead of an Ethernet card:
iptables –t nat –A POSTROUTING –s 192.168.1.0/24 –j MASQUERADE
Let's say our provider filters out all ports higher than 1024. In this case, we will need to change the source port as well, and not only the source IP address. This can be done by:
iptables –t nat –A POSTROUTING –s 192.168.1.0/24 –j SNAT –-to 1.2.3.1:1-1024
The laptop user seen in the previous figure is an IRC fan and he gives us a call saying he can't connect to any IRC networks. This means that the ip_conntrack module needs a little help, and we can give it to him by inserting the ip_conntrack_irc module in the kernel. Also, we might want to let users make successful FTP connections, and so we want to add the ip_conntrack_ftp module as well.
modprobe ip_conntrack_irc #or insmod ip_conntrack_irc
modprobe ip_conntrack_ftp #or insmod ip_conntrack_ftp
After a few weeks, the laptop user has convinced other users in the 192.168.1.0/24 network of how wonderful the IRC is; so we have about 20-30 users connecting to the same IRC network. Now, they have started to complain about how difficult it is to get connected on the IRC network, because the IRC network only allows a few connections from the same IP address. We figure that 32 IP addresses are enough for them, so we call the provider to assign us a /27 public IP subnet. For a few dollars extra, they assign us 1.2.4.0/27. We have to change the initial rule to:
iptables –t nat –A POSTROUTING –s 192.168.1.0/24 –j SNAT –-to 1.2.4.0-1.2.4.32
They stop complaining, but we realize that we don't use the public IP address of our Linux router for NAT anymore. Let's add that too; so we give them an extra IP address:
iptables –t nat –A POSTROUTING –s 192.168.1.0/24 –j SNAT –-to 1.2.4.0-1.2.4.32 –-to 1.2.3.1
One of our users gets into an argument on IRC, and gets flooded while SNAT mapps his IP address to 1.2.4.15. Our provider's flood-detection system automatically filters that IP address and sends us an email informing us about it. We need to stop SNAT to map any internal addresses to that IP address, so we do the following:
iptables –t nat –A POSTROUTING –s 192.168.1.0/24 –j SNAT –-to 1.2.4.0-1.2.4.14 –-to 1.2.4.16-1.2.4.32 –-to 1.2.3.1
One guy from accounting with the IP address 192.168.1.19 complains that he can't access any computers with IP addresses over 192.168.1.32. It is possible that he has changed his netmask to 255.255.255.227, and so all IP packets from his computer to computers in 192.168.1.0/24 that are not in 192.168.1.0/27 pass through the Linux router and get SNATed. To solve this problem, we have two alternatives.
The first would be not to SNAT 192.168.1.0/24 when the destination is another computer in 192.168.1.0/24:
iptables –t nat –A POSTROUTING –s 192.168.1.0/24 –d ! 192.168.1.0/24 –j SNAT –-to 1.2.4.0-1.2.4.32 –-to 1.2.3.1
The second choice we have is to SNAT only the packets that go out on Eth1:
iptables –t nat –A POSTROUTING –s 192.168.1.0/24 –o eth1 –j SNAT –-to 1.2.4.0-1.2.4.32 –-to 1.2.3.1
Our provider connected another location of our company to the same equipment, and since we are in the same VLAN, we don't have to build a tunnel between the routers at each location, but just route the networks through the Linux router at that location. On the other site, we have the network 192.168.2.0/24. We need to let computers in our network access computers in the 192.168.2.0/24 network without SNATing them:
iptables –t nat –I POSTROUTING –s 192.168.1.0/24 –d 192.168.2.0/24 –j ACCEPT
This command will insert the rule before the NAT rule; so if any packet from 192.168.1.0/24 is destined to any IP in the 192.168.2.0/24 network, this rule will match and the chain will not be analyzed further, so SNAT will not take place.
Jane, our secretary, is famous for her good coffee, but since she got the IRC fever, she's not doing anything anymore. The manager is angry about this but she doesn't want to fire Jane because she's addicted to her famous coffee; so she comes to ask us to do something about it. There are many things we can do in this matter, for instance drop packets from Jane (192.168.1.31) when trying to access ports 6666 to 6669 in the POSTROUTING chain:
iptables –t nat –I POSTROUTING –s 192.168.1.31 –p tcp –-dport 6666:6669 –j DROP
We might want to ask the manager what Jane is allowed to do. For instance, if the manager wants to allow Jane only web access, we can do the following:
iptables –t nat –I POSTROUTING –s 192.168.1.31 –p tcp –-dport ! 80 –j DROP
This rule will not SNAT Jane's IP address when trying to access something other than port 80 TCP, but it will SNAT her IP address when accessing any UDP services because UDP packets will not match this rule; so she will be able to access any DNS server outside our network.
DNAT with iptables
We will continue with the previous scenario for DNAT as well. One day, the manager calls us telling she needs to access her computer from home. Of course she can't do that because of her private IP address 192.168.1.50. We decide to allocate one of the public IP addresses that we have for her office computer, but if we were to create an alias on Eth0 for that, we would not only lose some IP addresses, but she also won't be in the same network as the others. The best solution is to map a public IP address (let's say 1.2.4.1) to her office computer's private IP address (192.168.1.50). This is, of course, DNAT:
iptables –t nat –A PREROUTING –d 1.2.4.1 –j DNAT –-to 192.168.1.50
So the next thing to do is to call her and tell him that whenever she tries to connect to her office computer from home, she must connect to 1.2.4.1.
Our intranet server has the IP address 192.168.1.100. One guy from the financial department has a broadband connection and asks us if he can access the intranet server from home. He gives us his public IP address as 1.2.5.17. We tell him that from his home he should try the IP address 1.2.4.2 in his web browser, and we execute:
iptables –t nat –A PREROUTING –s 1.2.5.17 –d 1.2.4.2 –p tcp –-dport 80 –j DNAT -–to 192.168.1.100
We think we might want to SSH to the intranet server from anywhere. It would not be a very wise idea to map one IP address to the intranet server as it is vital for our company, and if an SSH bug is discovered, we don't want that server to be hacked. A good idea would be to map a high-number port to the SSH port on the intranet server (this is PAT or NAPT).
iptables –t nat –A PREROUTING –d 1.2.4.2 –p tcp –-dport 65521 –j DNAT –-to 192.168.1.100:22
This way, when we are not at the office and we want to SSH into the intranet server, we open an SSH connection to 1.2.4.2 port 65521.
After a while, suppose we installed a web server with the IP address 192.168.1.200. The web server is www.mycompany.whatever and points in DNS to 1.2.4.5. To be accessible to the outside world, we perform the following:
iptables –t nat –A PREROUTING –d 1.2.4.5 –p tcp –-dport 80 –j DNAT –-to 192.168.1.200
Transparent Proxy
Transparent proxy is a way to force users to use a proxy server, even if their browsers are configured not to. You probably know about the benefits of using a proxy server bandwidth saving for cached pages and access control implementation (e.g. deny downloads of files that have dangerous extensions).
We can perform transparent proxy for all or some users to prevent them from bypassing the proxy whenever they want. This is especially good for children's computers to deny them access to sexually explicit sites, for example.
On our Linux router, we installed a Squid proxy server to cache some content from the Web. Also, we want to deny access to sex sites or malicious downloads for users. The users are not very pleased about using our proxy server, and they usually remove it from their browser configuration. We can force them to use the proxy server anyway. If the proxy server listens on port 3128 we will do the following:
iptables –t nat –A PREROUTING –s 192.168.1.0/24 –p tcp –-dport 80 –j REDIRECT –-to-port 3128
If we want to allow the manager (who has the IP address 192.168.1.50) to bypass the proxy server, we do so like this:
iptables –t nat –I PREROUTING –s 192.168.1.50 –p tcp –-dport 80 –j ACCEPT
So this rule will be matched in the PREROUTING chain, and she will be SNATed in the POSTROUTING chain.
legal notice
Our website is not responsible for the information contained by this article. Web-articles is a free articles resource.
Suggestion: If you need fresh, daily updated content for your website, feel free to use our service. Click here for more information.
Useful tools and features
If you like this article (tutorial), please link to it from your web page using the information above.
related articles
Let's think about one world-wide service that wouldn't have been possible without standardization, like email services. There are so many email client software applications out there, and all of them use the same protocols to transmit and receive data. Let's say you are in a company LAN and you want to send an email. Layer 7: You use an email client (like Outlook Express for example), which has SMTP and POP3 functions according to OSI Layer 7 (application). Layer 6: You send t...
2. The TCP/IP Internet Layer
The Internet layer in the TCP/IP model has the functions of OSI Layer 3 network. The purpose for the Internet layer is to select a path (preferably the best path) in the network for end-to-end delivery. The main protocol found at the Internet layer is IP (Internet Protocol), which provides connectionless, best-effort delivery routing of packets. IP handles logical addressing, and its primary concern is to find the best path between the endpoints, without caring about the contents of the packet. IP does not perform error checking and...
3. IP Addressing, IP Subnetting, and IP Supernetting
The Internet Protocol (IP) found at OSI Layer 3 is responsible for end-to-end delivery of data between computers in an IP network (the Internet). To find a path between two computers in a large network such as the Internet, computers must be uniquely identified. To do that, the Internet Protocol defines IP Addresses, which are unique 32 bit sequences of one and zeros. For example, 11000000101010000000000100000001 is a valid IP address. For the ease of use, IP addresses are represented in a form called the dotted decimal forma...
4. Public and Private IP Addresses
The Internet is a public network, and therefore a device connected directly to the Internet has a public IP address. Those IP addresses must be administered by someone in such way that two devices connected to the public network don't use the same IP address or that two networks don't have the same network address. This job was done by InterNIC (Internet Network Information Center), which has been succeeded by IANA (Internet Assigned Numbers Authority). IANA makes sure to provide unique IP network addresses to Internet Service Provide...
5. IP Supernetting or CIDR
CIDR stands for "Classless Inter-Domain Routing". It is a new addressing scheme for the Internet, intended to replace the old classful (Class A, B, C) address scheme. CIDR allows a more efficient allocation of IP addresses and uses routing aggregation for minimizing the routing table entries, and is also called supernetting. A recapitulation of classful IP addressing shows us the following: Address ...
6. Linux Security Threats
Creating firewalls may block some malicious attempts on your network, but this step is far from running an entirely secure network. As a network administrator or security consultant, to design a proper firewall for your network you need to know what you defend your network from. We cannot fully discuss this topic, even in 1000 pages, but we want to explain some principles that you should consider in running a safe network. As hard as it may seem to protect your network from the outside world, the most dangerous threats always come f...
7. IP Spoofing
An attacker might spoof a trusted IP address when communicating to a host in order to gain unauthorized access on that host. There are a variety of tools that can be found on the Internet to do IP spoofing. Using IP spoofing, attackers can also initiate Denial of Service by sending data with the source IP spoofed to the attacked IP address. The receiver then sends back replies that can contain large amounts of data to the attacked IP address resulting in...
8. BIND Domain Name System DNS
BIND (Berkley Internet Name Domain) is the most used DNS server on the Internet. Nowadays, every Linux distribution has a BIND package for DNS services. The problem with BIND and any DNS server is that in order to be able to translate names into IP addresses it has to communicate with a whole lot of other DNS servers, and so, filtering DNS packets is not possible. DNS services are vital for internet connection; so in order to disrupt services to victims, attackers have a great interest in bringing down DNS servers. Although BIN...
9. Simple Network Management Protocol SNMP
These days, most network devices use SNMP for remote monitoring and configuration. SNMP is a simple protocol used usually to create monitoring software that can retrieve information such as network traffic, CPU load, disk load, etc., and also to modify configuration of devices such as wireless equipment, broadband routers, etc. Most SNMP implementations on those kinds of network devices use version 1 or version 2, which have a very weak authentication method. SNMP version 1 contains a set of bugs in the way SNMP traps and reques...