[CentOS] Iptables masq traffic limiting

On Friday 29 August 2008 17:52, Joseph L. Casale wrote:

>  >Postrouting is the correct one.  After everything is routed it is MASQ
>  > before leaving the interface.
>
>  That makes sense, but I am stuck at making the transition, should I simply
>  pull the port specifications from my third line in the FORWARD chain to
> the first line in the POSTROUTING chain?
>
>  iptables -A POSTROUTING -t nat -o $WAN -p tcp -m multiport --dports 80,443
> -j MASQUERADE iptables -A FORWARD -i $WAN -o $LAN -m state --state
> RELATED,ESTABLISHED -j ACCEPT iptables -A FORWARD -i $LAN -o $WAN -m state
> --state NEW,ESTABLISHED,RELATED -j ACCEPT
>
>  Does that look groovy?

If your WAN interface is using a public IP and your LAN is using a private IP 
range then you need to MASQ everything leaving your LAN like this;

iptables -A POSTROUTING -t nat -o $WAN -j MASQUERADE

No port or packet types are needed as everything needs to be MASQed.

There is nothing you need to do to make the transition as all packets go 
though the Postrouting/Prerouting tables.


-- 

Regards
Robert

It is not just an adventure.
It is my job!!

Linux User #296285
http://counter.li.org