One-to-one NAT

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 20:06, 10 April 2009 (edit)
Stidem (Talk | contribs)
(SNAT/DNAT)
← Previous diff
Revision as of 20:15, 10 April 2009 (edit) (undo)
Stidem (Talk | contribs)
(Added better examples.)
Next diff →
Line 14: Line 14:
ifconfig vlan1:2 PUBLIC_IP2 netmask NETMASK broadcast BROADCAST ifconfig vlan1:2 PUBLIC_IP2 netmask NETMASK broadcast BROADCAST
Examples: Examples:
- ifconfig vlan1:1 173.xxx.xxx.249 netmask 255.255.255.240 broadcast 173.xxx.xxx.255+ ifconfig vlan1:1 173.xxx.xxx.250 netmask 255.255.255.240 broadcast 173.xxx.xxx.255
- ifconfig vlan1:2 173.xxx.xxx.250 netmask 255.255.255.240 broadcast 173.xxx.xxx.255+ ifconfig vlan1:2 173.xxx.xxx.251 netmask 255.255.255.240 broadcast 173.xxx.xxx.255
====Firewall==== ====Firewall====
Line 21: Line 21:
======SNAT/DNAT====== ======SNAT/DNAT======
-route all packets for the new public ip, to a certain local ip+Route all packets for the new public ip, to a certain local IP.
iptables -t nat -I PREROUTING -i vlan1 -d PUBLIC_IP -j DNAT --to-destination LAN_IP iptables -t nat -I PREROUTING -i vlan1 -d PUBLIC_IP -j DNAT --to-destination LAN_IP
-masquerade returned packets from the local ip to the public ip+Masquerade returned packets from the local ip to the public IP
iptables -t nat -I POSTROUTING -o vlan1 -s LAN_IP -j SNAT --to-source PUBLIC_IP iptables -t nat -I POSTROUTING -o vlan1 -s LAN_IP -j SNAT --to-source PUBLIC_IP
Line 30: Line 30:
iptables -t nat -I POSTROUTING 1 -p all -s LAN_IP -j SNAT --to-source PUBLIC_IP iptables -t nat -I POSTROUTING 1 -p all -s LAN_IP -j SNAT --to-source PUBLIC_IP
Example: Example:
- iptables -t nat -I POSTROUTING 1 -p all -s 192.168.0.20 -j SNAT --to-source 173.xxx.xxx.250+ iptables -t nat -I POSTROUTING 1 -p all -s 192.168.0.20 -j SNAT --to-source 173.xxx.xxx.251
-translate anything else from the lan to the "main" router ip+Translate anything else from the lan to the "main" router IP.
iptables -t nat -I POSTROUTING -o vlan1 -s LAN_SUBNET (ex. 192.168.1.0/24) -j SNAT --to-source MAIN_IP iptables -t nat -I POSTROUTING -o vlan1 -s LAN_SUBNET (ex. 192.168.1.0/24) -j SNAT --to-source MAIN_IP
Line 50: Line 50:
Which instead of forwarding just a single port, will let through all tcp/udp connections on all ports to this public ip-->lan ip. Which instead of forwarding just a single port, will let through all tcp/udp connections on all ports to this public ip-->lan ip.
-In other words forwarding all connections would be no firewalling what so ever.+In other words, forwarding all connections would be no firewalling for that IP address.
 + 
 +==Copy/Paste Examples==
 +===Startup Script===
 + # Save Startup
 + ifconfig vlan1:1 173.xxx.xxx.250 netmask 255.255.255.240 broadcast 173.xxx.xxx.255
 + ifconfig vlan1:2 173.xxx.xxx.251 netmask 255.255.255.240 broadcast 173.xxx.xxx.255
 +===Firewall Script===
 + # Save Firewall
 + iptables -t nat -I POSTROUTING -o vlan1 -s 192.168.0.0/24 -j SNAT --to-source 192.168.0.1
 +
 + # WAN .250 -> LAN .15
 + iptables -t nat -I PREROUTING -i vlan1 -d 173.xxx.xxx.250 -j DNAT --to-destination 192.168.0.15
 + iptables -t nat -I POSTROUTING -o vlan1 -s 192.168.0.15 -j SNAT --to-source 173.xxx.xxx.250
 + iptables -I FORWARD -p tcp -d 192.168.0.15 --dport 21 -j ACCEPT
 + iptables -I FORWARD -p tcp -d 192.168.0.15 --dport 80 -j ACCEPT
 + iptables -I FORWARD -p tcp -d 192.168.0.15 --dport 5900 -j ACCEPT
 +
 + # WAN .251 -> LAN .20
 + iptables -t nat -I PREROUTING -i vlan1 -d 173.xxx.xxx.251 -j DNAT --to-destination 192.168.0.15
 + iptables -t nat -I POSTROUTING -o vlan1 -s 192.168.0.15 -j SNAT --to-source 173.xxx.xxx.251
 + iptables -I FORWARD -p tcp -d 192.168.0.20 --dport 21 -j ACCEPT
 + iptables -I FORWARD -p tcp -d 192.168.0.20 --dport 80 -j ACCEPT
 + iptables -I FORWARD -p tcp -d 192.168.0.20 --dport 5900 -j ACCEPT
==Resources== ==Resources==

Revision as of 20:15, 10 April 2009

One-to-one NAT (aka Static NAT) is a way to make systems behind a firewall and configured with private IP addresses (those addresses reserved for private use in RFC 1918) appear to have public IP addresses.¹

These examples have been tested and work with multiple public static IPs. Tested with:

  • WRT54GL v.1.1 with DD-WRT RC6 and it works just fine.²
  • DD-WRT v24-sp2 (01/01/09) mega on Linksys WRT 600N V1

Contents

Setup

Startup

Set up new public static IP on dd-wrt WAN interface vlan1. This must be done for each public static IP and should be save to the Startup script using the Save Statup button.

ifconfig vlan1:1 PUBLIC_IP1 netmask NETMASK broadcast BROADCAST
ifconfig vlan1:2 PUBLIC_IP2 netmask NETMASK broadcast BROADCAST

Examples:

ifconfig vlan1:1 173.xxx.xxx.250 netmask 255.255.255.240 broadcast 173.xxx.xxx.255
ifconfig vlan1:2 173.xxx.xxx.251 netmask 255.255.255.240 broadcast 173.xxx.xxx.255

Firewall

SNAT/DNAT

Route all packets for the new public ip, to a certain local IP.

iptables -t nat -I PREROUTING -i vlan1 -d PUBLIC_IP -j DNAT --to-destination LAN_IP

Masquerade returned packets from the local ip to the public IP

iptables -t nat -I POSTROUTING -o vlan1 -s LAN_IP -j SNAT --to-source PUBLIC_IP

This may be a better method to masquerade returned packets from local IP to the public IP. (tested on DD-WRT v24-sp2 (01/01/09) mega)

iptables -t nat -I POSTROUTING 1 -p all -s LAN_IP -j SNAT --to-source PUBLIC_IP

Example:

iptables -t nat -I POSTROUTING 1 -p all -s 192.168.0.20 -j SNAT --to-source 173.xxx.xxx.251

Translate anything else from the lan to the "main" router IP.

iptables -t nat -I POSTROUTING -o vlan1 -s LAN_SUBNET (ex. 192.168.1.0/24) -j SNAT --to-source MAIN_IP
PORT FORWARD

Forward port X to above local IP

iptables -I FORWARD -p tcp -i vlan1 -d LAN_IP --dport X -j ACCEPT

Examples:

iptables -I FORWARD -p tcp -d 192.168.0.20 --dport 21 -j ACCEPT
iptables -I FORWARD -p tcp -d 192.168.0.20 --dport 80 -j ACCEPT
iptables -I FORWARD -p tcp -d 192.168.0.20 --dport 5900 -j ACCEPT

You could also replace above rule(s) with the following:

iptables -I FORWARD -p all -i vlan1 -d LAN_IP -j ACCEPT 

Which instead of forwarding just a single port, will let through all tcp/udp connections on all ports to this public ip-->lan ip.

In other words, forwarding all connections would be no firewalling for that IP address.

Copy/Paste Examples

Startup Script

# Save Startup
ifconfig vlan1:1 173.xxx.xxx.250 netmask 255.255.255.240 broadcast 173.xxx.xxx.255
ifconfig vlan1:2 173.xxx.xxx.251 netmask 255.255.255.240 broadcast 173.xxx.xxx.255

Firewall Script

# Save Firewall
iptables -t nat -I POSTROUTING -o vlan1 -s 192.168.0.0/24 -j SNAT --to-source 192.168.0.1

# WAN .250 -> LAN .15
iptables -t nat -I PREROUTING -i vlan1 -d 173.xxx.xxx.250 -j DNAT --to-destination 192.168.0.15
iptables -t nat -I POSTROUTING -o vlan1 -s 192.168.0.15 -j SNAT --to-source 173.xxx.xxx.250
iptables -I FORWARD -p tcp -d 192.168.0.15 --dport 21 -j ACCEPT
iptables -I FORWARD -p tcp -d 192.168.0.15 --dport 80 -j ACCEPT
iptables -I FORWARD -p tcp -d 192.168.0.15 --dport 5900 -j ACCEPT

# WAN .251 -> LAN .20
iptables -t nat -I PREROUTING -i vlan1 -d 173.xxx.xxx.251 -j DNAT --to-destination 192.168.0.15
iptables -t nat -I POSTROUTING -o vlan1 -s 192.168.0.15 -j SNAT --to-source 173.xxx.xxx.251
iptables -I FORWARD -p tcp -d 192.168.0.20 --dport 21 -j ACCEPT
iptables -I FORWARD -p tcp -d 192.168.0.20 --dport 80 -j ACCEPT
iptables -I FORWARD -p tcp -d 192.168.0.20 --dport 5900 -j ACCEPT

Resources

¹ http://www.shorewall.net/NAT.htm
² http://www.dd-wrt.com/phpBB2/viewtopic.php?t=24555