Ubuntu 14.04 as a Gateway / Router and a Firewall
Open a Terminal Ctrl+Alt+T
Enter following command to edit
interfaces
file:sudo vim /etc/network/interfaces
Edit the file with the following lines: (add your
netmask
andgateway
)auto lo iface lo inet loopback auto eth0 iface eth0 inet static address 182.x.x.x netmask x.x.x.x gateway x.x.x.x auto eth1 iface eth1 inet static address 192.168.0.1 netmask x.x.x.x
Now edit
/etc/sysctl.conf
and uncomment:# net.ipv4.ip_forward=1
so that it reads:
net.ipv4.ip_forward=1
and save it by entering
sudo sysctl -p /etc/sysctl.conf
To enable IP masquerading, enter following set of commands in terminal:
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE sudo iptables -A FORWARD -i eth1 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT sudo iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
Update: Fix strange "-–state" causing command to fail and fix nat MASQUERADE to eth0 (wan interface)
@chreekat's comment is correct that the Ethernet adapters are swapped in step 5 of @Anbu's answer, and as shown (as of 2017-02-21) creates A HUGE SECURITY HOLE that permits unrestricted access to the private network by anyone on the public network.
The corrected configuration for step 5 is shown below.
Theory of operation: (Rule #2) Packets ingressing from the public network (eth0) are accepted for forwarding out to the private network (eth1) if and only if the ingressing public packet is related to a conversation that was established by a host on the private network. (Rule #3) Accept all packets ingressing from the private network (eth1) and forward them out to the public network (eth0).
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
sudo iptables -A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
sudo iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT