Linux Networking Cookbook

3.14. Running Public Services on Private IP Addresses

Problem

You are running a public server on a private IP address, so it is not directly accessible to the Internet. So, you need to configure your iptables firewall to forward traffic to your server.

Solution

First of all, you need to add a third network interface card to your firewall box. We'll call it eth2, and assign it a different subnet than the LAN interface. This is very important—do not use the same subnet, or your networking will not work at all.

Let's say the three interfaces have these addresses:

• eth0 192.168.1.10 (LAN)

• eth1 11.22.33.44 (WAN)

• eth2 192.168.2.25 (DMZ)

You have one server in the DMZ with an IP address of 192.168.2.50.

Set up your firewall according to the previous recipes, so you have the four scripts: fw_ flush, fw_nat, fw_status, and the firewall init script. Add the new interface to fw_nat:

	DMZ_IFACE="eth2"

Add FORWARD rules to allow traffic between the DMZ, and your WAN and LAN interfaces:

	$ipt -A FORWARD -i $LAN_IFACE -o $DMZ_IFACE -m state \
	--state NEW,ESTABLISHED,RELATED -j ACCEPT
	$ipt -A FORWARD -i $DMZ_IFACE -o $LAN_IFACE -m state \
	--state ESTABLISHED,RELATED -j ACCEPT
	$ipt -A FORWARD -i $DMZ_IFACE -o $WAN_IFACE -m state \
	--state ESTABLISHED,RELATED -j ACCEPT
	$ipt -A FORWARD -i $WAN_IFACE -o $DMZ_IFACE -m state \
	--state NEW,ESTABLISHED,RELATED -j ACCEPT

Now, you need to route incoming HTTP traffic to your server with a PREROUTING rule:

 $ipt -t nat -A PREROUTING -p tcp -i $WAN_IFACE -d 11.22.33.44 \ ...