One-to-one NAT

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 20:15, 10 April 2009 (edit)
Stidem (Talk | contribs)
(Added better examples.)
← Previous diff
Revision as of 00:28, 12 May 2009 (edit) (undo)
Rlpowell (Talk | contribs)
(More with the actually working. The main firewall forwarding, in particular, was quite busted.)
Next diff →
Line 5: Line 5:
* WRT54GL v.1.1 with DD-WRT RC6 and it works just fine.² * WRT54GL v.1.1 with DD-WRT RC6 and it works just fine.²
* DD-WRT v24-sp2 (01/01/09) mega on Linksys WRT 600N V1 * DD-WRT v24-sp2 (01/01/09) mega on Linksys WRT 600N V1
 +* Tomato 1.23 (which sounds odd, but this is just iptables; it should work in any Linux-based router, except for the interface names)
__TOC__ __TOC__
==Setup== ==Setup==
 +
 +Everything in square brackets needs to be replaced by your values. Examples are at the bottom.
====Startup==== ====Startup====
Set up new public static IP on dd-wrt WAN interface vlan1. This must be done for each public static IP and should be save to the Startup script using the Save Statup button. Set up new public static IP on dd-wrt WAN interface vlan1. This must be done for each public static IP and should be save to the Startup script using the Save Statup button.
- ifconfig vlan1:1 PUBLIC_IP1 netmask NETMASK broadcast BROADCAST+ ifconfig vlan1:1 [PUBLIC_IP1] netmask [NETMASK] broadcast [BROADCAST]
- ifconfig vlan1:2 PUBLIC_IP2 netmask NETMASK broadcast BROADCAST+ ifconfig vlan1:2 [PUBLIC_IP2] netmask [NETMASK] broadcast [BROADCAST]
-Examples:+
- ifconfig vlan1:1 173.xxx.xxx.250 netmask 255.255.255.240 broadcast 173.xxx.xxx.255+
- ifconfig vlan1:2 173.xxx.xxx.251 netmask 255.255.255.240 broadcast 173.xxx.xxx.255+
====Firewall==== ====Firewall====
Line 22: Line 22:
Route all packets for the new public ip, to a certain local IP. Route all packets for the new public ip, to a certain local IP.
- iptables -t nat -I PREROUTING -i vlan1 -d PUBLIC_IP -j DNAT --to-destination LAN_IP+ iptables -t nat -I [PREROUTING] -p all -d [PUBLIC_IP] -j DNAT --to-destination [LAN_IP]
Masquerade returned packets from the local ip to the public IP Masquerade returned packets from the local ip to the public IP
- iptables -t nat -I POSTROUTING -o vlan1 -s LAN_IP -j SNAT --to-source PUBLIC_IP+ iptables -t nat -I [POSTROUTING] 1 -p all -s [LAN_IP] -j SNAT --to-source [PUBLIC_IP]
-This may be a better method to masquerade returned packets from local IP to the public IP. (tested on DD-WRT v24-sp2 (01/01/09) mega)+Translate anything else from the lan to the "main" router IP.
- iptables -t nat -I POSTROUTING 1 -p all -s LAN_IP -j SNAT --to-source PUBLIC_IP+ iptables -t nat -I [POSTROUTING] -o br0 -s [LAN_SUBNET] -j SNAT --to-source [MAIN_IP]
-Example:+
- iptables -t nat -I POSTROUTING 1 -p all -s 192.168.0.20 -j SNAT --to-source 173.xxx.xxx.251+
-Translate anything else from the lan to the "main" router IP.+In that last line, br0 may not always be correct; it's br0 on Tomato at least. You can use the ifconfig command to see the value for [INTERNAL_INTERFACE]; it's the one with the router's internal IP associated with it.
- iptables -t nat -I POSTROUTING -o vlan1 -s LAN_SUBNET (ex. 192.168.1.0/24) -j SNAT --to-source MAIN_IP+
======PORT FORWARD====== ======PORT FORWARD======
Forward port X to above local IP Forward port X to above local IP
- iptables -I FORWARD -p tcp -i vlan1 -d LAN_IP --dport X -j ACCEPT+ iptables -I FORWARD -p tcp -i vlan1 -d [LAN_IP] --dport X -j ACCEPT
-Examples:+
- iptables -I FORWARD -p tcp -d 192.168.0.20 --dport 21 -j ACCEPT+
- iptables -I FORWARD -p tcp -d 192.168.0.20 --dport 80 -j ACCEPT+
- iptables -I FORWARD -p tcp -d 192.168.0.20 --dport 5900 -j ACCEPT+
You could also replace above rule(s) with the following: You could also replace above rule(s) with the following:
- iptables -I FORWARD -p all -i vlan1 -d LAN_IP -j ACCEPT + iptables -I FORWARD -p all -i vlan1 -d [LAN_IP] -j ACCEPT
Which instead of forwarding just a single port, will let through all tcp/udp connections on all ports to this public ip-->lan ip. Which instead of forwarding just a single port, will let through all tcp/udp connections on all ports to this public ip-->lan ip.
Line 59: Line 52:
===Firewall Script=== ===Firewall Script===
# Save Firewall # Save Firewall
- iptables -t nat -I POSTROUTING -o vlan1 -s 192.168.0.0/24 -j SNAT --to-source 192.168.0.1+ iptables -t nat -I POSTROUTING -o br0 -s 192.168.0.0/24 -j SNAT --to-source 192.168.0.1
# WAN .250 -> LAN .15 # WAN .250 -> LAN .15
- iptables -t nat -I PREROUTING -i vlan1 -d 173.xxx.xxx.250 -j DNAT --to-destination 192.168.0.15+ iptables -t nat -I PREROUTING -p all -d 173.xxx.xxx.250 -j DNAT --to-destination 192.168.0.15
- iptables -t nat -I POSTROUTING -o vlan1 -s 192.168.0.15 -j SNAT --to-source 173.xxx.xxx.250+ iptables -t nat -I POSTROUTING -p all -s 192.168.0.15 -j SNAT --to-source 173.xxx.xxx.250
iptables -I FORWARD -p tcp -d 192.168.0.15 --dport 21 -j ACCEPT iptables -I FORWARD -p tcp -d 192.168.0.15 --dport 21 -j ACCEPT
iptables -I FORWARD -p tcp -d 192.168.0.15 --dport 80 -j ACCEPT iptables -I FORWARD -p tcp -d 192.168.0.15 --dport 80 -j ACCEPT
Line 69: Line 62:
# WAN .251 -> LAN .20 # WAN .251 -> LAN .20
- iptables -t nat -I PREROUTING -i vlan1 -d 173.xxx.xxx.251 -j DNAT --to-destination 192.168.0.15+ iptables -t nat -I PREROUTING -p all -d 173.xxx.xxx.251 -j DNAT --to-destination 192.168.0.15
- iptables -t nat -I POSTROUTING -o vlan1 -s 192.168.0.15 -j SNAT --to-source 173.xxx.xxx.251+ iptables -t nat -I POSTROUTING -p all -s 192.168.0.15 -j SNAT --to-source 173.xxx.xxx.251
iptables -I FORWARD -p tcp -d 192.168.0.20 --dport 21 -j ACCEPT iptables -I FORWARD -p tcp -d 192.168.0.20 --dport 21 -j ACCEPT
iptables -I FORWARD -p tcp -d 192.168.0.20 --dport 80 -j ACCEPT iptables -I FORWARD -p tcp -d 192.168.0.20 --dport 80 -j ACCEPT

Revision as of 00:28, 12 May 2009

One-to-one NAT (aka Static NAT) is a way to make systems behind a firewall and configured with private IP addresses (those addresses reserved for private use in RFC 1918) appear to have public IP addresses.¹

These examples have been tested and work with multiple public static IPs. Tested with:

  • WRT54GL v.1.1 with DD-WRT RC6 and it works just fine.²
  • DD-WRT v24-sp2 (01/01/09) mega on Linksys WRT 600N V1
  • Tomato 1.23 (which sounds odd, but this is just iptables; it should work in any Linux-based router, except for the interface names)

Contents

Setup

Everything in square brackets needs to be replaced by your values. Examples are at the bottom.

Startup

Set up new public static IP on dd-wrt WAN interface vlan1. This must be done for each public static IP and should be save to the Startup script using the Save Statup button.

ifconfig vlan1:1 [PUBLIC_IP1] netmask [NETMASK] broadcast [BROADCAST]
ifconfig vlan1:2 [PUBLIC_IP2] netmask [NETMASK] broadcast [BROADCAST]

Firewall

SNAT/DNAT

Route all packets for the new public ip, to a certain local IP.

iptables -t nat -I [PREROUTING] -p all -d [PUBLIC_IP] -j DNAT --to-destination [LAN_IP]

Masquerade returned packets from the local ip to the public IP

iptables -t nat -I [POSTROUTING] 1 -p all -s [LAN_IP] -j SNAT --to-source [PUBLIC_IP]

Translate anything else from the lan to the "main" router IP.

iptables -t nat -I [POSTROUTING] -o br0 -s [LAN_SUBNET] -j SNAT --to-source [MAIN_IP]

In that last line, br0 may not always be correct; it's br0 on Tomato at least. You can use the ifconfig command to see the value for [INTERNAL_INTERFACE]; it's the one with the router's internal IP associated with it.

PORT FORWARD

Forward port X to above local IP

iptables -I FORWARD -p tcp -i vlan1 -d [LAN_IP] --dport X -j ACCEPT

You could also replace above rule(s) with the following:

iptables -I FORWARD -p all -i vlan1 -d [LAN_IP] -j ACCEPT 

Which instead of forwarding just a single port, will let through all tcp/udp connections on all ports to this public ip-->lan ip.

In other words, forwarding all connections would be no firewalling for that IP address.

Copy/Paste Examples

Startup Script

# Save Startup
ifconfig vlan1:1 173.xxx.xxx.250 netmask 255.255.255.240 broadcast 173.xxx.xxx.255
ifconfig vlan1:2 173.xxx.xxx.251 netmask 255.255.255.240 broadcast 173.xxx.xxx.255

Firewall Script

# Save Firewall
iptables -t nat -I POSTROUTING -o br0 -s 192.168.0.0/24 -j SNAT --to-source 192.168.0.1

# WAN .250 -> LAN .15
iptables -t nat -I PREROUTING -p all -d 173.xxx.xxx.250 -j DNAT --to-destination 192.168.0.15
iptables -t nat -I POSTROUTING -p all -s 192.168.0.15 -j SNAT --to-source 173.xxx.xxx.250
iptables -I FORWARD -p tcp -d 192.168.0.15 --dport 21 -j ACCEPT
iptables -I FORWARD -p tcp -d 192.168.0.15 --dport 80 -j ACCEPT
iptables -I FORWARD -p tcp -d 192.168.0.15 --dport 5900 -j ACCEPT

# WAN .251 -> LAN .20
iptables -t nat -I PREROUTING -p all -d 173.xxx.xxx.251 -j DNAT --to-destination 192.168.0.15
iptables -t nat -I POSTROUTING -p all -s 192.168.0.15 -j SNAT --to-source 173.xxx.xxx.251
iptables -I FORWARD -p tcp -d 192.168.0.20 --dport 21 -j ACCEPT
iptables -I FORWARD -p tcp -d 192.168.0.20 --dport 80 -j ACCEPT
iptables -I FORWARD -p tcp -d 192.168.0.20 --dport 5900 -j ACCEPT

Resources

¹ http://www.shorewall.net/NAT.htm
² http://www.dd-wrt.com/phpBB2/viewtopic.php?t=24555