Postrouting And Ip Masquerading; Prerouting - Red Hat ENTERPRISE LINUX 4 System Administration Manual

Chapter 18. Firewalls
[root@myServer ~ ] # sysctl -p /etc/sysctl.conf

18.5.1. Postrouting and IP Masquerading

Accepting forwarded packets via the firewall's internal IP device allows LAN nodes to communicate
with each other; however they still cannot communicate externally to the Internet.
To allow LAN nodes with private IP addresses to communicate with external public networks,
configure the firewall for IP masquerading, which masks requests from LAN nodes with the IP address
of the firewall's external device (in this case, eth0):
[root@myServer ~ ] # iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
This rule uses the NAT packet matching table (-t nat) and specifies the built-in POSTROUTING
chain for NAT (-A POSTROUTING) on the firewall's external networking device (-o eth0).
POSTROUTING allows packets to be altered as they are leaving the firewall's external device.
The -j MASQUERADE target is specified to mask the private IP address of a node with the external IP
address of the firewall/gateway.

18.5.2. Prerouting

If you have a server on your internal network that you want make available externally, you can use the
-j DNAT target of the PREROUTING chain in NAT to specify a destination IP address and port where
incoming packets requesting a connection to your internal service can be forwarded.
For example, if you want to forward incoming HTTP requests to your dedicated Apache HTTP Server
at 172.31.0.23, use the following command:
[root@myServer ~ ] # iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to
172.31.0.23:80
This rule specifies that the nat table use the built-in PREROUTING chain to forward incoming HTTP
requests exclusively to the listed destination IP address of 172.31.0.23.
Note
If you have a default policy of DROP in your FORWARD chain, you must append a rule
to forward all incoming HTTP requests so that destination NAT routing is possible. To do
this, use the following command:
[root@myServer ~ ] # iptables -A FORWARD -i eth0 -p tcp --dport 80 -d 172.31.0.23 -
j ACCEPT
This rule forwards all incoming HTTP requests from the firewall to the intended
destination; the Apache HTTP Server behind the firewall.
184