How to setup a NAT server?

How to setup an NAT server?

Table of Contents

• What is NAT?
• How to setup NAT host?
• a shell script from vbird's book

1 What is NAT?

NAT stands for Network Address Transition, which is the basic function of gateway host. I try to hack Bluetooth tethering module in android this week, it include the Bluetooth Pan profile and the NAT setup process, which means in order to implement the Bluetooth tethering, first, two devices must be connected by Bluetooth Pan profile, and then the server part device acted as gateway host to supply the network forward service.

In other words, after Bluetooth Pan profile connected, the server must to setup its NAT rules to forward the IP packages. So how to setup NAT rules?

2 How to setup NAT host?

My memory is still fresh that at the start of my Linux journey, I setup my Linux desktop as an NAT host to provide Internet services for my lab's classmates. During the days as a programmer, I once did a job to hacking android's netd daemon to provide route tables setup function.

As a conclusion, there are following three steps to setup the NAT rules. The hardest part is maybe to understand iptables rules.

• Step one: open up the kernel's IP forward function.
• Step two: setup iptables rules.
• Step three: For the NAT host, maybe you should check the route tables.

3 a shell script  from vbird's book

#!/bin/bash
#made by vbird
# please input the right net device name
EXTIF="ppp0"              # external net interface, used to connected to outside.
INIF="eth0"             # internel LAN net interface
INNET="192.168.1.0/24" # internal LAN net cfg
export EXTIF INIF INNET
#######
## Step 1: Basic net settings and clean iptable rules
# 1. setup net interface 
echo "1" > /proc/sys/net/ipv4/tcp_syncookies
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
for i in /proc/sys/net/ipv4/conf/*/rp_filter; do
      echo "1" > $i
done
for i in /proc/sys/net/ipv4/conf/*/log_martians; do
      echo "1" > $i
done
for i in /proc/sys/net/ipv4/conf/*/accept_source_route; do
      echo "0" > $i
done
for i in /proc/sys/net/ipv4/conf/*/accept_redirects; do
      echo "0" > $i
done
for i in /proc/sys/net/ipv4/conf/*/send_redirects; do
      echo "0" > $i
done
## 2. cleanup iptable rules
PATH=/sbin:/usr/sbin:/bin:/usr/bin; export PATH
iptables -F
iptables -X
iptables -Z
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state RELATED -j ACCEPT
## Setup 2: setup iptable rules
# 1. insmod the necessary kernel modules
modules="ip_tables iptable_nat ip_nat_ftp ip_nat_irc ip_conntrack
ip_conntrack_ftp ip_conntrack_irc"
for mod in $modules
do
      testmod=`lsmod | grep "${mod} "`
      if [ "$testmod" == "" ]; then
            modprobe $mod
      fi
done
## 2. clean up NAT table
iptables -F -t nat
iptables -X -t nat
iptables -Z -t nat
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -t nat -P OUTPUT ACCEPT
# 3. setup as gateway host 
if [ "$INIF" != "" ]; then
   iptables -A INPUT -i $INIF -j ACCEPT
   echo "1" > /proc/sys/net/ipv4/ip_forward
   if [ "$INNET" != "" ]; then
     for innet in $INNET
     do
      iptables -t nat -A POSTROUTING -s $innet -o $EXTIF -j MASQUERADE
     done
   fi
fi
#### If your MSN cannot connected, or your access denied by some website
#### that maybe the problem of MTU
# iptables -A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -m tcpmss \
#         --mss 1400:1536 -j TCPMSS --clamp-mss-to-pmtu
# 4. internel service setting
# iptables -t nat -A PREROUTING -p tcp -i $EXTIF --dport 80 \
#        -j DNAT --to 192.168.1.210:80