One-to-one NAT
From DD-WRT Wiki
Revision as of 23:24, 15 January 2010 (edit) Phuzi0n (Talk | contribs) (→Firewall Script - - simplify/corrections) ← Previous diff |
Revision as of 23:26, 15 January 2010 (edit) (undo) Phuzi0n (Talk | contribs) (→Startup Script - - simplify) Next diff → |
||
Line 43: | Line 43: | ||
===Startup Script=== | ===Startup Script=== | ||
# Save Startup | # Save Startup | ||
- | ifconfig vlan1:1 173. | + | ifconfig vlan1:1 173.X.X.250 netmask 255.255.255.240 |
- | ifconfig vlan1:2 173. | + | ifconfig vlan1:2 173.X.X.251 netmask 255.255.255.240 |
+ | |||
===Firewall Script=== | ===Firewall Script=== | ||
# Save Firewall | # Save Firewall |
Revision as of 23:26, 15 January 2010
One-to-one NAT (aka Static NAT) is a way to make systems behind a firewall and configured with private IP addresses (those addresses reserved for private use in RFC 1918) appear to have public IP addresses.¹
These examples have been tested and work with multiple public static IPs. Tested with:
- WRT54GL v.1.1 with DD-WRT RC6 and it works just fine.²
- DD-WRT v24-sp2 (01/01/09) mega on Linksys WRT 600N V1
- Tomato 1.23 (which sounds odd, but this is just iptables; it should work in any Linux-based router, except for the interface names)
Contents |
Setup
Everything in square brackets needs to be replaced by your values. Examples are at the bottom.
Startup
Set up new public static IP on dd-wrt WAN interface vlan1. This must be done for each public static IP and should be save to the Startup script using the Save Statup button.
ifconfig vlan1:1 [PUBLIC_IP1] netmask [NETMASK] broadcast [BROADCAST] ifconfig vlan1:2 [PUBLIC_IP2] netmask [NETMASK] broadcast [BROADCAST]
Firewall
SNAT/DNAT
Route all packets for the new public ip, to a certain local IP.
iptables -t nat -I [PREROUTING] -d [PUBLIC_IP] -j DNAT --to-destination [LAN_IP]
Masquerade returned packets from the local ip to the public IP
iptables -t nat -I [POSTROUTING] -s [LAN_IP] -j SNAT --to-source [PUBLIC_IP]
PORT FORWARD
Forward port X to above local IP
iptables -I FORWARD -i [WAN_Interface] -d [LAN_IP] -p tcp --dport [Destination_Port] -j ACCEPT
You could also replace above rule(s) with the following:
iptables -I FORWARD -i [WAN_Interface] -d [LAN_IP] -j ACCEPT
Which instead of forwarding just a single port, will let through all tcp/udp connections on all ports to this public ip-->lan ip.
In other words, forwarding all connections would be no firewalling for that IP address.
Copy/Paste Examples
Startup Script
# Save Startup ifconfig vlan1:1 173.X.X.250 netmask 255.255.255.240 ifconfig vlan1:2 173.X.X.251 netmask 255.255.255.240
Firewall Script
# Save Firewall # WAN .250 -> LAN .15 iptables -t nat -I PREROUTING -d 173.X.X.250 -j DNAT --to 192.168.0.15 iptables -t nat -I POSTROUTING -s 192.168.0.15 -j SNAT --to 173.X.X.250 iptables -I FORWARD -d 192.168.0.15 -p tcp --dport 21 -j ACCEPT iptables -I FORWARD -d 192.168.0.15 -p tcp --dport 80 -j ACCEPT iptables -I FORWARD -d 192.168.0.15 -p tcp --dport 5900 -j ACCEPT # WAN .251 -> LAN .20 iptables -t nat -I PREROUTING -d 173.X.X.251 -j DNAT --to 192.168.0.20 iptables -t nat -I POSTROUTING -s 192.168.0.20 -j SNAT --to 173.X.X.251 iptables -I FORWARD -d 192.168.0.20 -p tcp --dport 21 -j ACCEPT iptables -I FORWARD -d 192.168.0.20 -p tcp --dport 80 -j ACCEPT iptables -I FORWARD -d 192.168.0.20 -p tcp --dport 5900 -j ACCEPT
Resources
¹ http://www.shorewall.net/NAT.htm
² http://www.dd-wrt.com/phpBB2/viewtopic.php?t=24555