Firewall-Nat-Linux - Netzwerk und Serveradministration

Interfaces

• cat /etc/network/interfaces

source /etc/network/interfaces.d/*

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
auto enp0s3
iface enp0s3 inet static
 address 192.168.5.1XX/24
 gateway 192.168.5.254
 post-up ip route add 10.88.0.0/16 via 192.168.Y.14
 post-up /usr/local/sbin/nat.sh

auto enp0s8
iface enp0s8 inet static
 address 172.16.1XX.1/24

auto enp0s9
iface enp0s9 inet static
 address 10.88.1XX.1/24


auto enp0s10
iface enp0s10 inet static
 address 10.1XX.1.1/24

Hosts

• cat /etc/hosts

127.0.0.1       localhost
127.0.1.1       fw.it1XX.int fw

# The following lines are desirable for IPv6 capable hosts
::1     localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters

Resolver

• cat /etc/resolv.conf

search it1XX.int
nameserver 192.168.Y.14

Nat

• cat /usr/local/sbin/nat.sh

#!/bin/bash
LAN="172.16.1XX.0/24"
SERVERS="10.1XX.1.0/24"
DMZ="10.88.1XX.0/24"
#Nat Regeln flushen
iptables -t nat -F 
#Nat Regelen setzen
iptables -t nat -A POSTROUTING -s $DMZ -d 192.168.Y.0/24 -j RETURN
iptables -t nat -A POSTROUTING -s $DMZ -d 10.88.0.0/16 -j RETURN
iptables -t nat -A POSTROUTING -s $DMZ -o enp0s3 -j MASQUERADE
iptables -t nat -A POSTROUTING -s $LAN -o enp0s3 -j MASQUERADE
iptables -t nat -A POSTROUTING -s $SERVERS -o enp0s3 -j MASQUERADE

• chmod +x /usr/local/sbin/nat.sh

Forward

• echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
• sysctl -p