iptables cheatsheet

Just as the filters table has three pre-defined chains, INPUT, OUTPUT, FORWARD, the nat table has 2 predefined chains:

(PREROUTING and POSTROUTING).

These are checked against any network traffic relevant to those chains and a decision is made based on the outcome of those rules.

Think of these chains from the perspective of traffic to the internal, inside, protected network.

For outgoing packets, outbound. (e.g. after the packets have been passed around the inside network.) VMs on the inside network have their source ip hidden (re-written, or "translated") on the way to connect to an external IP server.

For incoming packets. inbound. (e.g. before packets are delivered to the protected, inside, hidden, privatly addressed VMs) For outside clients to be able to connect to a VM server, but presenting a public IP address to the client, and translating that public ip address to the VM's actual inside private ip address.

The predefined targets for -t nat tables are:

Destination NAT only works with the PREROUTING chain. i.e. for allowing outside clients to connect to a service that is offered on an inside VM. So for inbound packets.

We are changing the destination address of inbound packets for all the next examples: iptables -t nat -A PREROUTING -j DNAT --to {addr[-addr][:port[-port]]}

Example to translate and pass ALL inbound traffic to 192.168.111.11 seen on interface eth0 iptables -t nat -A PREROUTING -i eth0 -j DNAT --to 192.168.111.11

Change inbound web traffic seen on eth0 to destination addresses 5.6.7.8, and port 8080. iptables -t nat -A PREROUTING -p tcp --dport 80 -i eth0 -j DNAT --to 5.6.7.8:8080

Change destination address of traffic heading to 10.10.10.10 on our host, to an inside host, whose address is 192.168.111.11 iptables -t nat -A PREROUTING -d 10.10.10.10/32 -j DNAT --to 192.168.111.11

More encompassing example would be to specify any inbound traffic seen on interface eth0 and translate the address to send it to host: ..111.11 iptables -t nat -A PREROUTING -i eth0 -j DNAT --to 192.168.111.11

–to-destination <ipaddr>[-<ipaddr>][:port-port]

You can specifiy a single address or a range of addresses You can specify a single port or a range of ports You would do that if you want to balance between several public addresses

For dynamic (dhcp) clients on the inside, use -j MASQUERADING

A specialized case of DNAT, if you want to redirect packets to a different incoming port. i.e. PREROUTING only. For example: send incoming port-80 web traffic to our squid (transparent) proxy iptables -t nat -A PREROUTING -i eth0 -p tcp –dport 80 -j REDIRECT –to-port 3128

(for PREROUTING (and OUTPUT chain if locally generated traffic))

Source NAT only works the POSTROUTING chain. (i.e. outbound )

• (and INPUT chain for locally destined packets)_

Similar to Masquerading , but SNAT is for static addresses. Please note: the "–to address" is NOT the address that you are trying to get to, i.e. NOT the destination address, but rather it is the address to which to translate the source address.

e.g. "please translate my source address 192.168.111.11 to 1.2.3.4"

Obviously 1.2.3.4 has to be an address on the outside that can be reachable from the outside, so the reply packets know how to get back.

iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to 1.2.3.4 iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to 1.2.3.4-1.2.3.6 iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to 1.2.3.4:1-1023

We are changing the source address of packets destined to the outside. So that the outside thinks packets are coming from the natted source, specified by the –to address, not the original inside host address.

You can specifiy a single address or a range of addresses You can specify a single port or a range of ports

SNAT ONLY works with static ip addresses (NOT DHCP) That is why it has –to-source This a requirement. For SNAT one has to specify the new source-IP explicitly.

Change source addresses to 1.2.3.4. iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to 1.2.3.4

SNAT means "source nat" and not "static nat", although it is for static addresses.

For example, if we have changed incoming traffic to a different DNAT recipient We have to fix the reverse direction by altering reply packets to look like they came from the original destination address. For example we can change destination address of traffic heading to 10.10.10.10, an address on our host, to an inside host, whose address is 192.168.111.11

iptables -t nat -A PREROUTING -d 10.10.10.10/32 -j DNAT --to 192.168.111.11

fix the reverse direction: iptables -t nat -A POSTROUTING -s 192.168.111.11 -j SNAT --to 10.10.10.10

Like SNAT, it ONLY works with the POSTROUTING chain, i.e. for VMs or clients to connect to an external IP address, and have the VM's source ip address hidden/re-written/translated as the specified externally routable address.

iptables -t nat -A POSTROUTING -o ens33 -j MASQUERADE

This masks the private ip address of an inside node with the external ip address of the firewall/gateway. It works with clients that use DHCP. Some times the address may change if the client gets has a new dhcp lease, the client (inside addr changes). by using -j MASQUERADE the NAT process checks every time.

MASQUERADE also automatically keeps track of the inside clients that have connected outbound so that outbound reply packets can be DNAT'ed back to the originating inside client. - no need to configure PREROUTING chain rules for these inbout reply packets.

Because MASQUERADING keeps track of all these translated connections, it costs more in performance compared to the static that use -j SNAT.

The SNAT target requires you to give it an IP address to apply to all the outgoing packets. The MASQUERADE target lets you give it an interface, and whatever address is on that interface is the address that is applied to all the outgoing packets.

In addition, with SNAT, the kernel's connection tracking keeps track of all the connections when the interface is taken down and brought back up; the same is not true for the MASQUERADE target.

–to-destination address[:port] -j SNAT –to-destination address-address[:port-port] -j SNAT –to-port

–to-destination address[:port] -j DNAT –to-destination address-address[:port-port] -j DNAT