Ubuntu Server Guide by Neil Smyth

Author:Neil Smyth
Language: eng
Format: mobi
Publisher: UNKNOWN
Published: 2018-06-17T23:00:00+00:00

In the above example replace eth0, eth1, and 192.168.0.0/24 with the appropriate interfaces and IP range for your network.

• Finally, disable and re-enable ufw to apply the changes:

sudo ufw disable && sudo ufw enable IP Masquerading should now be enabled. You can also add any additional FORWARD rules to the /etc/ufw/ before.rules. It is recommended that these additional rules be added to the ufw-before-forward chain.

3.3.2. iptables Masquerading

iptables can also be used to enable Masquerading.

• Similar to ufw, the first step is to enable IPv4 packet forwarding by editing /etc/sysctl.conf and uncomment the following line:

net.ipv4.ip_forward=1 If you wish to enable IPv6 forwarding also uncomment:

net.ipv6.conf.default.forwarding=1

• Next, execute the sysctl command to enable the new settings in the configuration file:

sudo sysctl -p

• IP Masquerading can now be accomplished with a single iptables rule, which may differ slightly based on

your network configuration:

sudo iptables -t nat -A POSTROUTING -s 192.168.0.0/16 -o ppp0 -j MASQUERADE

The above command assumes that your private address space is 192.168.0.0/16 and that your Internetfacing device is ppp0. The syntax is broken down as follows:

• -t nat -- the rule is to go into the nat table

• -A POSTROUTING -- the rule is to be appended (-A) to the POSTROUTING chain

• -s 192.168.0.0/16 -- the rule applies to traffic originating from the specified address space

• -o ppp0 -- the rule applies to traffic scheduled to be routed through the specified network device

• -j MASQUERADE -- traffic matching this rule is to "jump" (-j) to the MASQUERADE target to be

manipulated as described above

• Also, each chain in the filter table (the default table, and where most or all packet filtering occurs) has a default policy of ACCEPT, but if you are creating a firewall in addition to a gateway device, you may have set the policies to DROP or REJECT, in which case your masqueraded traffic needs to be allowed through the FORWARD chain for the above rule to work:

sudo iptables -A FORWARD -s 192.168.0.0/16 -o ppp0 -j ACCEPT sudo iptables -A FORWARD -d 192.168.0.0/16 -m state \

--state ESTABLISHED,RELATED -i ppp0 -j ACCEPT

The above commands will allow all connections from your local network to the Internet and all traffic related to those connections to return to the machine that initiated them.

• If you want masquerading to be enabled on reboot, which you probably do, edit /etc/rc.local and add any commands used above. For example add the first command with no filtering:

iptables -t nat -A POSTROUTING -s 192.168.0.0/16 -o ppp0 -j MASQUERADE

3.4. Logs

Firewall logs are essential for recognizing attacks, troubleshooting your firewall rules, and noticing unusual activity on your network. You must include logging rules in your firewall for them to be generated, though, and logging rules must come before any applicable terminating rule (a rule with a target that decides the fate of the packet, such as ACCEPT, DROP, or REJECT).

If you are using ufw, you can turn on logging by entering the following in a terminal:

sudo ufw logging on

To turn logging off in ufw, simply replace on with off in the above command.

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.