Quelltext der Seite Firewall-NAT-Linux-nftables - Netzwerk und Serveradminsitration

[[Kategorie:Firewall]]
[[Kategorie:nftables]]

= Erklärung =

* XX = Platznummer
* Y = Klassensaal

= Hostname =

* hostnamectl set-hostname fw.it1XX.int

= Interfaces =

* cat /etc/network/interfaces

<pre>
source /etc/network/interfaces.d/*

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
#WAN
auto enp0s3
iface enp0s3 inet static
 address 192.168.9.1XX/24
 gateway 192.168.9.254
 post-up ip route add 10.88.0.0/16 via 192.168.Y.88

#LAN
auto enp0s8
iface enp0s8 inet static
 address 172.16.1XX.1/24

#DMZ
auto enp0s9
iface enp0s9 inet static
 address 10.88.1XX.1/24

#SERVERS
auto enp0s10
iface enp0s10 inet static
 address 10.1XX.1.1/24
</pre>

= Hosts =

* cat /etc/hosts

<pre>
127.0.0.1       localhost
127.0.1.1       fw.it1XX.int fw

# The following lines are desirable for IPv6 capable hosts
::1     localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
</pre>

= Resolver =

* cat /etc/resolv.conf

<pre>
search it1XX.int
nameserver 192.168.Y.88
</pre>

= nftables Installation =

* apt install nftables

= NAT mit nftables =

* vim /etc/nftables.conf

<pre>
#!/usr/sbin/nft -f

# Variablen
define LAN = 172.16.1XX.0/24
define SERVERS = 10.1XX.1.0/24
define DMZ = 10.88.1XX.0/24

# Alte Regeln löschen
flush ruleset

# NAT-Tabelle mit Regeln
table ip nat {
    chain postrouting {
        type nat hook postrouting priority 100; policy accept;
        
        # DMZ nach 192.168.Y.0/24 - kein NAT (RETURN)
        ip saddr $DMZ ip daddr 192.168.Y.0/24 return
        
        # DMZ nach 10.88.0.0/16 - kein NAT (RETURN)
        ip saddr $DMZ ip daddr 10.88.0.0/16 return
        
        # DMZ nach außen (enp0s3) - Masquerade
        ip saddr $DMZ oif enp0s3 masquerade
        
        # LAN nach außen - Masquerade
        ip saddr $LAN oif enp0s3 masquerade
        
        # SERVERS nach außen - Masquerade
        ip saddr $SERVERS oif enp0s3 masquerade
    }
}
</pre>

= nftables-Service aktivieren =

* systemctl enable nftables
* systemctl start nftables

= Forward =

* echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
* sysctl -p

= Reboot =

* systemctl reboot