Home / server / Questions / 258774
Accepted
Paul Hoffman
Asked: 2011-04-13 06:19:50 +0800 CST

Making Ubuntu a minimal NAT?

  • 772

I need to make a quick-and-dirty NAT out of a Ubuntu 10.10 box. Just "this side is NATted with DHCP handing out 192.168.x.0/24" and "this side gateways to the Internet", and nothing else interesting. There seems to be many choices with varying degrees of documentation. What's the easiest way to do this?

ubuntu nat

2 Answers

  1. Best Answer
    echo "net.ipv4.ip_forward=1" >> /etc/sysctl.d/10-network-security.conf
iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -o externaleth -j SNAT --to externalip
apt-get install dhcp3-server
gedit /etc/default/dhcp3-server
interfaces="internaleth1" #eth2 or eth3 or whatyouhave :D
gedit /etc/dhcp3/dhcpd.conf
subnet 192.168.0.0 netmask 255.255.255.0 {
    option routers                  192.168.0.1; #yours itnernal ip
    option subnet-mask              255.255.255.0;

    option domain-name              "mylan.com";
    option domain-name-servers       192.168.0.1;
    range 192.168.0.2 192.168.0.254;
}

apt-get install dns-masq
service dhcp3-server restart
    1. setting nat
    2. install dhcpd-server
    3. install dnsmasq to handle option domain-name-servers 192.168.0.1; or you could set it to 8.8.8.8 and skip install dns-masq
    • 2

  2. I in fact do exactly this -- for a couple of years an old HP mini-tower served as my home network's router, until it fried in a blackout (hardware's not worth troubleshooting the fault); I'll be building a brand new system for this very same purpose shortly, so I'll be sure to write up a how-to as I do that.

    In the meantime, however, I'll point you to the same resource I use: Shorewall, and specifically the how-to for a two-interface firewall. The site's documentation also has similar articles for one- and three-interface setups, so pick the one that best suits your needs. I find using Shorewall to be a lot easier and a lot more intuitive than directly manipulating iptables (Shorewall is really just a configuration layer that sits atop iptables, so the end result is very much the same, except that it handles a lot of basic, low-level stuff you wouldn't even think of, like smurfs (packets with a broadcast address as the source) and martians (packets with impossible source addresses)).

    • 1