One-to-one NAT
From DD-WRT Wiki
Revision as of 00:33, 22 January 2010 (edit) Phuzi0n (Talk | contribs) (→Setup) ← Previous diff |
Revision as of 00:38, 22 January 2010 (edit) (undo) Phuzi0n (Talk | contribs) (Removed reference to Tomato because the scripts are now dd-wrt centric.) Next diff → |
||
Line 5: | Line 5: | ||
* WRT54GL v.1.1 with DD-WRT RC6 and it works just fine.² | * WRT54GL v.1.1 with DD-WRT RC6 and it works just fine.² | ||
* DD-WRT v24-sp2 (01/01/09) mega on Linksys WRT 600N V1 | * DD-WRT v24-sp2 (01/01/09) mega on Linksys WRT 600N V1 | ||
- | * Tomato 1.23 (which sounds odd, but this is just iptables; it should work in any Linux-based router, except for the interface names) | ||
__TOC__ | __TOC__ |
Revision as of 00:38, 22 January 2010
One-to-one NAT (aka Static NAT) is a way to make systems behind a firewall and configured with private IP addresses (those addresses reserved for private use in RFC 1918) appear to have public IP addresses.¹
These examples have been tested and work with multiple public static IPs. Tested with:
- WRT54GL v.1.1 with DD-WRT RC6 and it works just fine.²
- DD-WRT v24-sp2 (01/01/09) mega on Linksys WRT 600N V1
Contents |
Setup
Begin by setting your WAN to use one of the static addresses using the web ui and then use these scripts to add the rest. Everything in square brackets needs to be replaced by your values. Examples are at the bottom.
Startup
Set up new public static IP on dd-wrt WAN interface. This must be done for each public static IP and should be saved to the Startup script using the Save Startup button on the Administration -> Commands page.
If wan_iface causes trouble then try wan_ifname instead and notify phuzi0n
WANIF=`nvram get wan_iface` WANMASK=`nvram get wan_netmask` ifconfig $WANIF:1 [PUBLIC_IP1] netmask $WANMASK ifconfig $WANIF:2 [PUBLIC_IP2] netmask $WANMASK ifconfig $WANIF:3 [PUBLIC_IP3] netmask $WANMASK
Firewall
SNAT/DNAT
Route all packets for the new public ip, to a certain local IP.
iptables -t nat -I [PREROUTING] -d [PUBLIC_IP] -j DNAT --to-destination [LAN_IP]
Masquerade returned packets from the local ip to the public IP
iptables -t nat -I [POSTROUTING] -s [LAN_IP] -j SNAT --to-source [PUBLIC_IP]
PORT FORWARD
Forward port X to above local IP
iptables -I FORWARD -i [WAN_Interface] -d [LAN_IP] -p tcp --dport [Destination_Port] -j ACCEPT
You could also replace above rule(s) with the following:
iptables -I FORWARD -i [WAN_Interface] -d [LAN_IP] -j ACCEPT
Which instead of forwarding just a single port, will let through all tcp/udp connections on all ports to this public ip-->lan ip.
In other words, forwarding all connections would be no firewalling for that IP address.
Copy/Paste Examples
Startup Script
# Save Startup WANIF=`nvram get wan_iface` WANMASK=`nvram get wan_netmask` ifconfig $WANIF:1 173.X.X.250 netmask $WANMASK ifconfig $WANIF:2 173.X.X.251 netmask $WANMASK ifconfig $WANIF:3 173.X.X.252 netmask $WANMASK
Firewall Script
# Save Firewall # WAN .250 -> LAN .15 iptables -t nat -I PREROUTING -d 173.X.X.250 -j DNAT --to 192.168.0.15 iptables -t nat -I POSTROUTING -s 192.168.0.15 -j SNAT --to 173.X.X.250 iptables -I FORWARD -d 192.168.0.15 -p tcp --dport 21 -j ACCEPT iptables -I FORWARD -d 192.168.0.15 -p tcp --dport 80 -j ACCEPT iptables -I FORWARD -d 192.168.0.15 -p tcp --dport 5900 -j ACCEPT # WAN .251 -> LAN .20 iptables -t nat -I PREROUTING -d 173.X.X.251 -j DNAT --to 192.168.0.20 iptables -t nat -I POSTROUTING -s 192.168.0.20 -j SNAT --to 173.X.X.251 iptables -I FORWARD -d 192.168.0.20 -p tcp --dport 21 -j ACCEPT iptables -I FORWARD -d 192.168.0.20 -p tcp --dport 80 -j ACCEPT iptables -I FORWARD -d 192.168.0.20 -p tcp --dport 5900 -j ACCEPT
Resources
¹ http://www.shorewall.net/NAT.htm
² http://www.dd-wrt.com/phpBB2/viewtopic.php?t=24555