IPTABLES Rules Chain Architecture NAT Example

Important Notes
1) –sport –dport if we use the both option then we have to mention whether packet  is tcp or udp.
2) Iptables Configuration file located in /etc/sysconfig/iptabels
3)USEFUL Verification Command
To check what are the ports are open or not
#netstat -tulpn | grep port-number
Check Particular Service Status in Iptables
#iptables -L -v -n | grep (Service Name|Port Number)

LEVEL - 1
#iptables -A (INPUT|OUTPUT|FORWARD) -(s|d) (SOURCE|DESTINATION) -p (tcp|udp|icmp)  --sport|--dport -j (ACCEPT|REJECT|DROP)

#iptables
-A
INPUT
-p
tcp
-s

Source

--sport

-j
ACCEPT

OUTPUT
udp
REJECT

-d
Destination
--dport


FORWARD
DROP

icmp
LOG



LEVEL -2
NAT operate in the router.
Main Advantages is
1) Security, 2) address conversation.
-t nat
-i
Input Interface
Prerouting
DNAT
-o
Output Interface
Postrouting
SNAT
Router public -eth0    private- eth1
NOTE: nat iptabels rule we have to specify the two interface
-i eth1 -o eth0 – Outgoing Connection (First PRIVATE & then PUBLIC) 
-i eth0 -o eth1 – Incoming Connection (First PUBLIC & then PRIVATE)



SNAT:  (PREROUTING)
DNAT: (POSTROUTING)
Change source IP address (where is coming from) done in POSTROUTING.
change destination IP Address(where is going to) should done in PREROUTING
EX: $IPTABLES -t nat -A POSTROUTING -o eth0 -j SNAT --to 10.0.0.5

-j DNAT --to-destination w.x.y.z [ Change receipent address ] (mostly used in port forwarding or redirection)
$IPTABLES -t nat -A PREROUTING -p tcp -i eth0 –dport 80 -j DNAT --to 192.168.145.14:80

-j SNAT --to-source a.b.c.d [ Change the Source Address ]
PREROUTING:
1)alter the packet before routing
2)packet translation happen when packet comes to the system
3) Translate the destination IP something matches routing on the local server.
4)Translate one address always into another(one to one)
Mainly SNAT is used in may illustration.

POSTROUGING
1)alter packet after routing
2) Packet translation happens when packet leaving the system.
3) Translate source IP address of packet matches to the routing on destination server.
NOTE: PNAT – Port Network Address Translation

LEVEL - 3
-v(verbose)
-L(List)
-n(IP Address)
--line-numbers
Display iptables with Clear Details.
#iptables -t nat -v -L -n --line-numbers
-m state
-m(match)
--state
NEW
1st connection
RELATED
1response to 1st connection
ESTABLISHED
Further connection.

# iptabels .. -m state –state  NEW,RELATED,ESTABLISHED
-m [MATCH]
Specify any 2 ports
--match multiport --source-ports 23,24
--m mac
-m state
-m tcp/udp
-m iprange
--dport 6881:6886 [ allow 6881, 6882, 6883, 6884,6885 ]
Specify the continuous port
-p target policy
#Iptables -A INPUT -j DROP write into
#iptables -P INPUT DROP.
#iptabels -P OUPUT DROP.
#iptables -P FORWARD DROP.










Important iptables Rules
1)Configure  Router  Gateway using Iptables(NAT )
a) net.ipv4.ip_forward = 1 Line into /etc/sysctl.conf
To update #sysctl -p /etc/sysctl.conf (or)
echo 1 > /proc/sys/net/ipv4/ip_forward

b) #iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
-j MASQUERADE Replace sender address by router address.
2) How to Delete the ipatables nat table.
#iptables -t nat  -D POSTROUTING 1
Example 1) #iptabels -t (Table-Name) -D (PREROUTING|POSTROUTING|OUTPUT) Rule-No
Example 2)#iptabels -D (INPUT|FORWARD|OUTPUT) Rule-no
3)#iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW,RELTATED,ESTABLISHED -j ACCEPT
 1) client to server connection - NEW - 1st connections request
  2) server response to client   - RELATED – response to the request
  3) client create further  connection - ESTABLISHED – Further connection.
NOTE: INVALID – packet does not match any connection.
4)#iptables -t nat -A POSTROUTING -p tcp -o eth0 -j SNAT --to-source 194.236.50.155-194.236.50.160:1024-32000
5) Redirect port 80 traffic to 8080
#iptables -t nat -A PREROUTING -p tcp –dport 80 -j REDIRECT –to-port 8080
6)Initialize  the User-defined NEW Chains
#iptabels -N valid-src
#iptaebls  -N valid-dst
Iptables Important Picture.
http://networknuts.files.wordpress.com/2012/05/networknuts-iptables.png
SNAT & DNAT terms varies by vendor.
http://www.iu.hio.no/teaching/materials/MS004A/html/pictures/iptablesETH.png

Related post