LINUX NAT firewall configuration using IPTables

slugman92 · 02-21-2011, 04:54 AM

I have got 3 PC's behind a LInux server NAT firewall, on a 192.168.1.0/24 subnet,

PC1 = 192.168.1.10
PC2 = 192.168.1.11
PC3 = 192.168.1.12

All PC's need to send mail by SMTP direct to my ISP mail server.

I need to RDP to PC 3 only from the Internet.

I don't want any other access from outside.

And Typical access inside the network between the PC's

Can someone please help me with the commands i would use to do this, ive been looking at it for a while now and i haven't got anywhere.

Thanks in advance. .

dracuss · 02-21-2011, 05:45 AM

You could use port forwarding for that. Google for examples, there are plenty

Oliv' · 02-21-2011, 11:03 AM

Hello,

A tuto that I really love: http://www.gentoo.org/doc/en/home-router-howto.xml
Be aware that it is Gentoo specific, but for a lot of things, like iptables rules, it is common to all linux distributions.

Hope it helps,

Oliv'

win32sux · 02-21-2011, 07:45 PM

FWIW, it would go something like this:

Code:

iptables -P FORWARD DROP

iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

iptables -A FORWARD -p TCP -i $LAN_IFACE -o $WAN_IFACE \
-m iprange --src-range 192.168.1.10-192.168.1.12 \
-d $SMTP_SERVER --dport 25 -m state --state NEW -j ACCEPT

iptables -A FORWARD -p TCP -i $WAN_IFACE -o $LAN_IFACE \
-d 192.168.1.12 --dport 3389 -m state --state NEW -j ACCEPT

iptables -t nat -A PREROUTING -p TCP -i $WAN_IFACE --dport 3389 \
-j DNAT --to-destination 192.168.1.12

iptables -t nat -A POSTROUTING -o $WAN_IFACE -j MASQUERADE

echo 1 > /proc/sys/net/ipv4/ip_forward