Linux and NAT

[seanf77]

I know you can set up Linux as a firewall/gateway/NAT, allowing you to share an Internet connection amongst several clients. But is it also possible to set it up so that you can have, for example, a web server behind the firewall, and allow users on the Internet to access the web server (much like Windows 2000 ICS and NAT) via the one public IP? Mark Minasi's book seems to mention that this is not possible with ipchains.


Thanks!

 

[ifincham]

Hi,

Yes, this is easy with iptables, the successor to ipchains for 2.4 series kernels. You just need simple code like :

echo 1 > /proc/sys/net/ipv4/ip_forward
/sbin/modprobe iptable_nat
/sbin/iptables -t nat -A PREROUTING -p tcp --dport 80 -i eth1-j DNAT --to 172.16.16.10:8080

That example would change the destination on port 80 traffic arriving on interface eth1 to port 8080 of 172.16.16.10 . See Rusty Russell's howto -->

http://netfilter.samba.org/unreliable-guides/NAT-HOWTO/NAT-HOWTO.linuxdoc.html

.

Hope this helps

 

[stanhubble]

You also might want to check out smoothwall, does all this with a nice web administration. It will also do vpn , dmz and lots of other things.

http://www.smoothwall.org

stan