- Next, we'll change the Netfilter rules
on our Ubuntu router host to finish our configuration
for forwarding packets between the internet
and the Ubuntu local host.
We'll use a shell script instead
of typing individual commands.
I keep my shell script
in the documents folder type cd Documents, press Enter.
Type ls, press Enter.
The myfw.sh file is our shell script.
Let's open the shell script
by typing nano space myfw.sh, press Enter.
The rules you are seeing here are
the default Netfilter ones, introduced
in our host firewall lesson.
I added a couple of more rules to the input chain
to prevent losing my remote desktop
and secure shell connections.
- p tcp, specifies the transmission control protocol
or tcp used by a remote desktop or secure shell request.
- s 04/0 indicates the scope of the source IPs,
which covers all the possible incoming IP addresses.
- d 04/0 is the same, except
for it's for destination IPs.
Here, I'm saying that the firewall
should accept any incoming and outgoing packets
through port 3389 and 22.
Port 3389 is for remote desktop while 22 is
for secure shell.
Please note that, this is mainly for the convenience
of my demonstrations not too much for security.
There are many more things you can do to harden
these firewall rules.
Let's start by typing iptables.
- A FORWARD -I eth1 -o.
etH10 -j ACCEPT.
- A FORWARD appends a new rule
to the Netfilter forward chain dash.
- i stands for input network interface.
- o stands for output network interface.
The input network interface in this scenario is eth1.
The output network interface is eth0.
The bottom line is that this rule forwards packets
from an internal network interface, eth1
to the external network interface eth0.
Let's add the next rule.
Type iptables -A FORWARD -m state --state.
ESTABLISHED,RELATED -j ACCEPT.
The next rule makes Netfilter accept packets
that are part of an existing connection.
As long as there are packets coming back as responses
to the packets you previously sent out,
the Netfilter firewall will accept them.
- m stands for match.
And the rule is checking whether a packet matches
is established or related state.
Now, let's add another rule.
Type iptables -t nat -A POSTROUTING -O eth0.
- j MASQUERADE, M-A-S-Q-U-E-R-A-D-E.
- t stands for table
and the Netfilter table we're using here is net,
or network address translation.
This rule changes the source IP of all the outgoing packets
into the IP address of the external network interface card
of the Ubuntu router host.
The word masquerade refers to this process of changing
the source IP of all the outgoing packets, so that
they all appear to be coming from a single host
when in fact they are from multiple internal hosts
with different IPS.
Now, we're done with our script.
Let's save it by pressing Control and X together.
Type Y press Enter,
to accept the current file name.
Don't forget to run the shell script.
Type sudo ./myfw.sh press Enter.
The shell script ran without any problems.
It just enabled forwarding.