One-to-one NAT

From DD-WRT Wiki

Revision as of 01:34, 12 April 2010 by Phuzi0n (Talk | contribs)
Jump to: navigation, search

One-to-one NAT (aka Static NAT) is a way to make systems behind a firewall and configured with private IP addresses (those addresses reserved for private use in RFC 1918) appear to have public IP addresses.¹

These examples have been tested and work with multiple public static IPs. Tested with:

  • WRT54GL v.1.1 with DD-WRT RC6 and it works just fine.²
  • DD-WRT v24-sp2 (01/01/09) mega on Linksys WRT 600N V1

Contents

Setup

Begin by setting your WAN to use one of the static addresses using the web ui and then use these scripts to add the rest. Everything in square brackets needs to be replaced by your values. Examples are at the bottom.

Startup

Set up new public static IP on dd-wrt WAN interface. This must be done for each public static IP and should be saved to the Startup script using the Save Startup button on the Administration -> Commands page. If you do not know how to calculate your broadcast address, then enter your WAN IP and subnet mask into this [calculator].

If wan_iface causes trouble then try wan_ifname instead and notify phuzi0n

WANIF=`nvram get wan_iface`
WANMASK=`nvram get wan_netmask`
ifconfig $WANIF:1 [PUBLIC_IP1] netmask $WANMASK broadcast [BROADCAST]
ifconfig $WANIF:2 [PUBLIC_IP2] netmask $WANMASK broadcast [BROADCAST]
ifconfig $WANIF:3 [PUBLIC_IP3] netmask $WANMASK broadcast [BROADCAST]

Firewall

SNAT/DNAT

Route all packets for the new public IP, to a certain local IP.

iptables -t nat -I PREROUTING -d [PUBLIC_IP] -j DNAT --to-destination [LAN_IP]

Route packets on a port on the new public IP, to a different port of a local IP. Note that you can skip [LAN_Port] if it matches [Destination_Port].

iptables -t nat -I PREROUTING -d [PUBLIC_IP] -p tcp --dport [Destination_Port] -j DNAT --to-destination [LAN_IP]:[LAN_Port] 

Masquerade returned packets from the local ip to the public IP

iptables -t nat -I POSTROUTING -s [LAN_IP] -j SNAT --to-source [PUBLIC_IP]
PORT FORWARD

Forward port X to above local IP

iptables -I FORWARD -d [LAN_IP] -p tcp --dport [Destination_Port] -j ACCEPT

You could also replace above rule(s) with the following:

iptables -I FORWARD -d [LAN_IP] -j ACCEPT 

Which instead of forwarding just a single port, will let through all tcp/udp connections on all ports to this public ip-->lan ip.

In other words, forwarding all connections would be no firewalling for that IP address.

Copy/Paste Examples

Startup Script

# Save Startup
WANIF=`nvram get wan_iface`
WANMASK=`nvram get wan_netmask`
ifconfig $WANIF:1 173.X.X.250 netmask $WANMASK broadcast [BROADCAST]
ifconfig $WANIF:2 173.X.X.251 netmask $WANMASK broadcast [BROADCAST]
ifconfig $WANIF:3 173.X.X.252 netmask $WANMASK broadcast [BROADCAST]

Firewall Script

# Save Firewall

# WAN .250 -> LAN .15
iptables -t nat -I PREROUTING -d 173.X.X.250 -j DNAT --to 192.168.0.15
iptables -t nat -I POSTROUTING -s 192.168.0.15 -j SNAT --to 173.X.X.250
iptables -I FORWARD -d 192.168.0.15 -p tcp --dport 21 -j ACCEPT
iptables -I FORWARD -d 192.168.0.15 -p tcp --dport 80 -j ACCEPT
iptables -I FORWARD -d 192.168.0.15 -p tcp --dport 5900 -j ACCEPT

# WAN .251 -> LAN .20
iptables -t nat -I PREROUTING -d 173.X.X.251 -j DNAT --to 192.168.0.20
iptables -t nat -I POSTROUTING -s 192.168.0.20 -j SNAT --to 173.X.X.251
iptables -I FORWARD -d 192.168.0.20 -p tcp --dport 21 -j ACCEPT
iptables -I FORWARD -d 192.168.0.20 -p tcp --dport 80 -j ACCEPT
iptables -I FORWARD -d 192.168.0.20 -p tcp --dport 5900 -j ACCEPT

Resources

¹ http://www.shorewall.net/NAT.htm
² http://www.dd-wrt.com/phpBB2/viewtopic.php?t=24555
http://www.dd-wrt.com/phpBB2/viewtopic.php?p=400472#400472