Linux Networking Cookbook

3.5. Building an Internet-Connection Sharing Firewall on a Dynamic WAN IP Address

Problem

Your Linux firewall box is assembled and ready to go to work. But first, you must set up a firewall and Internet connection sharing. You're still on IPv4, and your LAN uses mostly nonroutable private IP addresses, so you want a Network Address Translation (NAT) firewall. You have a dynamically assigned WAN address.

Solution

It's all done with iptables.

Don't connect the WAN interface yet. Make sure there are no open ports on your firewall machine. Test this by running netstat on the firewall box. This command shows all listening and TCP and UDP sockets and established connections:

	admin@firewall:~# netstat -untap

If you find any open ports, close them. Any services you want to run can be restarted later, but for now, it's safer to shut them off, with one exception: you need a DHCP client running so the WAN interface will work correctly. DHCP clients run by default on all Linux distributions, so you shouldn't have to enable it.

Next, edit /etc/sysctl.conf so that it has these kernel parameters. The first one is the most important because you must have it to enable sharing your Internet connection:

	net.ipv4.ip_forward = 1
	net.ipv4.icmp_echo_ignore_broadcasts = 1
	net.ipv4.tcp_syncookies = 1
	net.ipv4.conf.all.accept_source_route = 0

Next, copy the following script, call it /usr/local/bin/fw_nat, and make it read/write/ executable for root only, mode 0700:

 #!/bin/sh ##/usr/local/bin/fw_nat #iptables firewall ...