Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people, just like you, are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions

Linux NAT the easy way

Posted on 2011-09-13
Last Modified: 2012-05-12

I'd like to use a linux box as a network address translator, but for external IP addresses, and preferably without the use of IPTables

I like to use APF, but they (advanced policy firewall) don't seem to have the functionality I'm interested in.

I'm only interested in one thing, passing all data intended for ip:port -> alternate_ip:port and back again

So: -> connects to my linux box on -> is network address translated and all packets intended for are sent to -> <> then from -> the response is sent to -> back to[on incoming port]

So exactly like a NAT on a local router, only internet based.

I'm familiar with nginx, pound, apache methods, but they are much more complicated than what I want.

I want simple. Because simple works on any IP and any port with any service.

I'm a Perl guy, so if there is a Perl method I'd be interested too.

Thanks for any help!
Question by:dr34m3rs
  • 6
  • 2
  • 2
LVL 21

Expert Comment

ID: 36533130
NAT does not forward ports, that is what PAT is for.

This is easily achieved with iptables, but I know you said you prefer not to use it.  Any specific reason for that?  I can't think of anything to do this that would give you less headaches than a few iptables rules.

iptables IS the easy way, and many experts here can help with that.

Author Comment

ID: 36533151
Would I be able to use custom IPTables rules with APF? Since APF configures IPTables? Or would my custom rules be overwritten when APF is restarted?
LVL 21

Accepted Solution

Papertrip earned 400 total points
ID: 36533225
Hmm that's quite possible, I wouldn't be the least bit surprised if it did.  APF probably wants complete control to avoid manual errors and maybe flushes the table and rewrites it via cron.  That's just a guess though, I've never used APF.

Are you just using APF for "simple" things like blocking all incoming ports except maybe 80 and 443 ?

If so, and you switched to managing iptables directly, once you setup a single rule to say allow TCP/80, you can just copy the entire rule and change the port to say 443.  Basically what I'm saying is, if you need just basic firewalling then the rules are easy and there are TONS of links out there, along with lots of experts here ;)
Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.


Author Comment

ID: 36533372
Cool, thanks for your help and advice in this matter. Really appreciate it.

I'm considering all aspects of this and will do a little research on my own.

I use APF because it's very easy to setup and I've not had time to learn the iptables syntax. I don't generally do anything fancy with my firewall rules. APF rocks because you can setup allow / deny lists and it works beautifully with custom scripts and a program called "brute force defender" which basically just scans logs and blocks brute force attacks to ports using APF.

I use APF for closing everything but the ports needed by services I use.

I did a quick scan of google before going out for the night and found some references to custom iptables - so we'll see how that goes.


Expert Comment

ID: 36533413
The "easy" way could be using a GUI to configure iptables... check this: http://www.fwbuilder.org/

Author Comment

ID: 36533923
hvillanu: Thanks for the idea, but no gui on my linux boxes. Could do webmin or something I suppose.

And an idea I had was: if APF does reset the custom iptables, I could just write a custom start script that adds them at boot and upon manual restarts...

Assisted Solution

hvillanu earned 100 total points
ID: 36533966

Well you can " construct/built/test " the Script on a Linux with KDE, Gnome, or whatever you like, then export to script, and finally run it on Production with iptables-restore or shell to import it.
Webmin it's ok too, but I prefer fwbuilder.

Author Comment

ID: 36537662
Alright, I had some time and googled:

APF uses a preroute.rules file and you can do things like

$IPT -t nat -I PREROUTING -p tcp --dport 3625 -j REDIRECT --to-port 25
$IPT -t nat -I PREROUTING -p tcp --dport 3636 -j REDIRECT --to-port 8443

Although the above example is port related and not ip:port combo, I'm confident I'll be able to find my answer. If I run into issues I'll ask another question here in the correct area.

Thanks for all the help Paper and Villa

Author Closing Comment

ID: 36537673
Thanks again!

Author Comment

ID: 36539322

Fooling around with this I was able to determine the following:

This works on CentOS 6 64-bit linux running Advanced Policy Firewall (APF)

1) Turn on IP forwarding
# echo 1 >/proc/sys/net/ipv4/ip_forward

2) Place the following rule into your /etc/apf/preroute.rules file:

$IPT -t nat -A PREROUTING -p tcp --dport PORTNUMBER-i eth0 -j DNAT --to-destination X.X.X.X:PORT

# PORTNUMBER = the port number on your eth0 interface (incoming)
# eth0 = the interface you'd like to use
# x.x.x.x:port (your ip:port) example = (can be intranet or internet it seems)

3) Place the following rule into your /etc/apf/postroute.rules file:


4) Restart APF and look for any errors near the top of the output near
"loading preroute.rules"

# apf --restart

Hope this helps someone out as much as it has helped me!

Featured Post

Easy, flexible multimedia distribution & control

Coming soon!  Ideal for large-scale A/V applications, ATEN's VM3200 Modular Matrix Switch is an all-in-one solution that simplifies video wall integration. Easily customize display layouts to see what you want, how you want it in 4k.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Choice of router 8 32
Help with a subnetting question 7 58
ASA 5505 not passing traffic to Netgear router 22 49
VPN problems 4 21
Join Greg Farro and Ethan Banks from Packet Pushers (http://packetpushers.net/podcast/podcasts/pq-show-93-smart-network-monitoring-paessler-sponsored/) and Greg Ross from Paessler (https://www.paessler.com/prtg) for a discussion about smart network …
Shadow IT is coming out of the shadows as more businesses are choosing cloud-based applications. It is now a multi-cloud world for most organizations. Simultaneously, most businesses have yet to consolidate with one cloud provider or define an offic…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…

856 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question