Linux Networking Cookbook

6.4. Configuring Simplest Internet Connection Sharing

Problem

You want to enable Internet connection sharing on your Linux router. You have one or more networks behind your router using private address ranges. You don't want to set up a firewall because you're taking care of that elsewhere, or you just want to do some testing, so you want plain old simple Internet connection sharing.

Solution

Use this iptables script, which follows the conventions used in Chapter 3:

	#!/bin/sh
	##/usr/local/bin/nat_share
	#minimal iptables script for
	#sharing an Internet connection

	#define variables
	ipt="/sbin/iptables"
	mod="/sbin/modprobe"
	WAN_IFACE="eth1"

	#load kernel modules
	$mod ip_tables
	$mod iptable_filter
	$mod iptable_nat
	$mod ip_conntrack
	$mod iptable_mangle
	$mod ipt_MASQUERADE
	$mod ip_nat_ftp
	$mod ip_nat_irc
	$mod ip_conntrack_ftp
	$mod ip_conntrack_irc

	#Flush all active rules and delete all custom chains
	$ipt -F
	$ipt -t nat -F
	$ipt -t mangle -F
	$ipt -X
	$ipt -t nat -X
	$ipt -t mangle -X

	#Set default policies
	$ipt -P INPUT ACCEPT
	$ipt -P FORWARD ACCEPT
	$ipt -P OUTPUT ACCEPT
	$ipt -t nat -P OUTPUT ACCEPT
	$ipt -t nat -P PREROUTING ACCEPT
	$ipt -t nat -P POSTROUTING ACCEPT
	$ipt -t mangle -P PREROUTING ACCEPT
	$ipt -t mangle -P POSTROUTING ACCEPT

	#always have an entry for interface lo
	$ipt -A INPUT -i lo -j ACCEPT
	$ipt -A OUTPUT -i lo -j ACCEPT

	#rewrite source addresses to WAN address
	$ipt -t nat -A POSTROUTING -o $WAN_IFACE -j SNAT --to-source 22.33.44.55

Of course, you must substitute your own interface ...