Basic NAT with iptables

Assume: eth0 is going to Internet (public), eth1 is going to LAN (internal)

sudo sh -c "echo 1 > /proc/sys/net/ipv4/ip_froward"


# Masquerade will alter ip address
# /sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

# Only related and established packet allowed to internal network
# /sbin/iptables -A FORWARD -i eth0 -o eth1 -m state
   --state RELATED,ESTABLISHED -j ACCEPT

# Allow all packet (new connection) from internal to public network
# /sbin/iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT




More iptables script from http://ubuntuforums.org/showthread.php?t=1905018





PATH=/usr/sbin:/sbin:/bin:/usr/bin

#
# delete all existing rules.
#
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X

# Always accept loopback traffic
iptables -A INPUT -i lo -j ACCEPT


# Allow established connections, and those not coming from the outside
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i ethwan -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i ethwan -o eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow services
iptables -A INPUT -p tcp --dport 22 -j ACCEPT                #ssh
iptables -A INPUT -p udp -i eth0 --dport 53 -j ACCEPT        #dns
iptables -A INPUT -p udp -i eth1 --dport 53 -j ACCEPT        #dns
iptables -A INPUT -p udp -i eth0 --dport 67 -j ACCEPT        #dhcp
iptables -A INPUT -p udp -i eth1 --dport 67 -j ACCEPT        #dhcp
iptables -A INPUT -p tcp -s 128.173.14.84 --dport 137 -j ACCEPT
iptables -A INPUT -p tcp -s 128.173.14.84 --dport 138 -j ACCEPT
iptables -A INPUT -p tcp -s 128.173.14.84 --dport 139 -j ACCEPT
iptables -A INPUT -p tcp -s 128.173.14.84 --dport 445 -j ACCEPT

# Setup Forwarding between interfaces (all none listed are blocked)
iptables -A FORWARD -i eth0 -o ethwan -j ACCEPT
iptables -A FORWARD -i eth1 -o ethwan -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT

# Masquerade.
iptables -t nat -A POSTROUTING -o ethwan -j MASQUERADE

# Don't forward from the outside to the inside.
iptables -A INPUT -j DROP
iptables -A FORWARD -j DROP

# Save the new rules
iptables-save > /etc/iptables.rules