One-to-one NAT
From DD-WRT Wiki
Revision as of 20:06, 10 April 2009 (edit) Stidem (Talk | contribs) (→SNAT/DNAT) ← Previous diff |
Revision as of 20:15, 10 April 2009 (edit) (undo) Stidem (Talk | contribs) (Added better examples.) Next diff → |
||
Line 14: | Line 14: | ||
ifconfig vlan1:2 PUBLIC_IP2 netmask NETMASK broadcast BROADCAST | ifconfig vlan1:2 PUBLIC_IP2 netmask NETMASK broadcast BROADCAST | ||
Examples: | Examples: | ||
- | ifconfig vlan1:1 173.xxx.xxx. | + | ifconfig vlan1:1 173.xxx.xxx.250 netmask 255.255.255.240 broadcast 173.xxx.xxx.255 |
- | ifconfig vlan1:2 173.xxx.xxx. | + | ifconfig vlan1:2 173.xxx.xxx.251 netmask 255.255.255.240 broadcast 173.xxx.xxx.255 |
====Firewall==== | ====Firewall==== | ||
Line 21: | Line 21: | ||
======SNAT/DNAT====== | ======SNAT/DNAT====== | ||
- | + | Route all packets for the new public ip, to a certain local IP. | |
iptables -t nat -I PREROUTING -i vlan1 -d PUBLIC_IP -j DNAT --to-destination LAN_IP | iptables -t nat -I PREROUTING -i vlan1 -d PUBLIC_IP -j DNAT --to-destination LAN_IP | ||
- | + | Masquerade returned packets from the local ip to the public IP | |
iptables -t nat -I POSTROUTING -o vlan1 -s LAN_IP -j SNAT --to-source PUBLIC_IP | iptables -t nat -I POSTROUTING -o vlan1 -s LAN_IP -j SNAT --to-source PUBLIC_IP | ||
Line 30: | Line 30: | ||
iptables -t nat -I POSTROUTING 1 -p all -s LAN_IP -j SNAT --to-source PUBLIC_IP | iptables -t nat -I POSTROUTING 1 -p all -s LAN_IP -j SNAT --to-source PUBLIC_IP | ||
Example: | Example: | ||
- | iptables -t nat -I POSTROUTING 1 -p all -s 192.168.0.20 -j SNAT --to-source 173.xxx.xxx. | + | iptables -t nat -I POSTROUTING 1 -p all -s 192.168.0.20 -j SNAT --to-source 173.xxx.xxx.251 |
- | + | Translate anything else from the lan to the "main" router IP. | |
iptables -t nat -I POSTROUTING -o vlan1 -s LAN_SUBNET (ex. 192.168.1.0/24) -j SNAT --to-source MAIN_IP | iptables -t nat -I POSTROUTING -o vlan1 -s LAN_SUBNET (ex. 192.168.1.0/24) -j SNAT --to-source MAIN_IP | ||
Line 50: | Line 50: | ||
Which instead of forwarding just a single port, will let through all tcp/udp connections on all ports to this public ip-->lan ip. | Which instead of forwarding just a single port, will let through all tcp/udp connections on all ports to this public ip-->lan ip. | ||
- | In other words forwarding all connections would be no firewalling | + | In other words, forwarding all connections would be no firewalling for that IP address. |
+ | |||
+ | ==Copy/Paste Examples== | ||
+ | ===Startup Script=== | ||
+ | # Save Startup | ||
+ | ifconfig vlan1:1 173.xxx.xxx.250 netmask 255.255.255.240 broadcast 173.xxx.xxx.255 | ||
+ | ifconfig vlan1:2 173.xxx.xxx.251 netmask 255.255.255.240 broadcast 173.xxx.xxx.255 | ||
+ | ===Firewall Script=== | ||
+ | # Save Firewall | ||
+ | iptables -t nat -I POSTROUTING -o vlan1 -s 192.168.0.0/24 -j SNAT --to-source 192.168.0.1 | ||
+ | |||
+ | # WAN .250 -> LAN .15 | ||
+ | iptables -t nat -I PREROUTING -i vlan1 -d 173.xxx.xxx.250 -j DNAT --to-destination 192.168.0.15 | ||
+ | iptables -t nat -I POSTROUTING -o vlan1 -s 192.168.0.15 -j SNAT --to-source 173.xxx.xxx.250 | ||
+ | iptables -I FORWARD -p tcp -d 192.168.0.15 --dport 21 -j ACCEPT | ||
+ | iptables -I FORWARD -p tcp -d 192.168.0.15 --dport 80 -j ACCEPT | ||
+ | iptables -I FORWARD -p tcp -d 192.168.0.15 --dport 5900 -j ACCEPT | ||
+ | |||
+ | # WAN .251 -> LAN .20 | ||
+ | iptables -t nat -I PREROUTING -i vlan1 -d 173.xxx.xxx.251 -j DNAT --to-destination 192.168.0.15 | ||
+ | iptables -t nat -I POSTROUTING -o vlan1 -s 192.168.0.15 -j SNAT --to-source 173.xxx.xxx.251 | ||
+ | iptables -I FORWARD -p tcp -d 192.168.0.20 --dport 21 -j ACCEPT | ||
+ | iptables -I FORWARD -p tcp -d 192.168.0.20 --dport 80 -j ACCEPT | ||
+ | iptables -I FORWARD -p tcp -d 192.168.0.20 --dport 5900 -j ACCEPT | ||
==Resources== | ==Resources== |
Revision as of 20:15, 10 April 2009
One-to-one NAT (aka Static NAT) is a way to make systems behind a firewall and configured with private IP addresses (those addresses reserved for private use in RFC 1918) appear to have public IP addresses.¹
These examples have been tested and work with multiple public static IPs. Tested with:
- WRT54GL v.1.1 with DD-WRT RC6 and it works just fine.²
- DD-WRT v24-sp2 (01/01/09) mega on Linksys WRT 600N V1
Contents |
Setup
Startup
Set up new public static IP on dd-wrt WAN interface vlan1. This must be done for each public static IP and should be save to the Startup script using the Save Statup button.
ifconfig vlan1:1 PUBLIC_IP1 netmask NETMASK broadcast BROADCAST ifconfig vlan1:2 PUBLIC_IP2 netmask NETMASK broadcast BROADCAST
Examples:
ifconfig vlan1:1 173.xxx.xxx.250 netmask 255.255.255.240 broadcast 173.xxx.xxx.255 ifconfig vlan1:2 173.xxx.xxx.251 netmask 255.255.255.240 broadcast 173.xxx.xxx.255
Firewall
SNAT/DNAT
Route all packets for the new public ip, to a certain local IP.
iptables -t nat -I PREROUTING -i vlan1 -d PUBLIC_IP -j DNAT --to-destination LAN_IP
Masquerade returned packets from the local ip to the public IP
iptables -t nat -I POSTROUTING -o vlan1 -s LAN_IP -j SNAT --to-source PUBLIC_IP
This may be a better method to masquerade returned packets from local IP to the public IP. (tested on DD-WRT v24-sp2 (01/01/09) mega)
iptables -t nat -I POSTROUTING 1 -p all -s LAN_IP -j SNAT --to-source PUBLIC_IP
Example:
iptables -t nat -I POSTROUTING 1 -p all -s 192.168.0.20 -j SNAT --to-source 173.xxx.xxx.251
Translate anything else from the lan to the "main" router IP.
iptables -t nat -I POSTROUTING -o vlan1 -s LAN_SUBNET (ex. 192.168.1.0/24) -j SNAT --to-source MAIN_IP
PORT FORWARD
Forward port X to above local IP
iptables -I FORWARD -p tcp -i vlan1 -d LAN_IP --dport X -j ACCEPT
Examples:
iptables -I FORWARD -p tcp -d 192.168.0.20 --dport 21 -j ACCEPT iptables -I FORWARD -p tcp -d 192.168.0.20 --dport 80 -j ACCEPT iptables -I FORWARD -p tcp -d 192.168.0.20 --dport 5900 -j ACCEPT
You could also replace above rule(s) with the following:
iptables -I FORWARD -p all -i vlan1 -d LAN_IP -j ACCEPT
Which instead of forwarding just a single port, will let through all tcp/udp connections on all ports to this public ip-->lan ip.
In other words, forwarding all connections would be no firewalling for that IP address.
Copy/Paste Examples
Startup Script
# Save Startup ifconfig vlan1:1 173.xxx.xxx.250 netmask 255.255.255.240 broadcast 173.xxx.xxx.255 ifconfig vlan1:2 173.xxx.xxx.251 netmask 255.255.255.240 broadcast 173.xxx.xxx.255
Firewall Script
# Save Firewall iptables -t nat -I POSTROUTING -o vlan1 -s 192.168.0.0/24 -j SNAT --to-source 192.168.0.1 # WAN .250 -> LAN .15 iptables -t nat -I PREROUTING -i vlan1 -d 173.xxx.xxx.250 -j DNAT --to-destination 192.168.0.15 iptables -t nat -I POSTROUTING -o vlan1 -s 192.168.0.15 -j SNAT --to-source 173.xxx.xxx.250 iptables -I FORWARD -p tcp -d 192.168.0.15 --dport 21 -j ACCEPT iptables -I FORWARD -p tcp -d 192.168.0.15 --dport 80 -j ACCEPT iptables -I FORWARD -p tcp -d 192.168.0.15 --dport 5900 -j ACCEPT # WAN .251 -> LAN .20 iptables -t nat -I PREROUTING -i vlan1 -d 173.xxx.xxx.251 -j DNAT --to-destination 192.168.0.15 iptables -t nat -I POSTROUTING -o vlan1 -s 192.168.0.15 -j SNAT --to-source 173.xxx.xxx.251 iptables -I FORWARD -p tcp -d 192.168.0.20 --dport 21 -j ACCEPT iptables -I FORWARD -p tcp -d 192.168.0.20 --dport 80 -j ACCEPT iptables -I FORWARD -p tcp -d 192.168.0.20 --dport 5900 -j ACCEPT
Resources
¹ http://www.shorewall.net/NAT.htm
² http://www.dd-wrt.com/phpBB2/viewtopic.php?t=24555