Show pagesourceOld revisionsBacklinksBack to top × Table of Contents fw3 NAT Configurations NAT Diagnostics NAT Example Configurations Port forwarding for IPv4 (DNAT) DNAT to translate a LAN-side address on the WAN-side LAN-side public server Source NAT (SNAT) MASQUERADE Transparent proxy rule (external) fw3 NAT Configurations The fw3 application has extensive support for NAT filterning. NAT is a powerful feature and is credited with extending the life of the IPv4 protocol. As with other firewall section, this section will not delve into NAT background and theory. Some useful links for this are: https://www.netfilter.org/documentation/HOWTO/NAT-HOWTO.html https://www.karlrupp.net/en/computer/nat_tutorial https://www.systutorials.com/816/port-forwarding-using-iptables/ OpenWrt supports DNAT, SNAT, MASQUERADING. NAT Diagnostics See Netfilter Management for analyzing the netfilter rules and investigating conntrack sessions. NAT Example Configurations This section contains typical uses of the fw3 NAT features Port forwarding for IPv4 (DNAT) The goal of this rule is to redirect all WAN-side SSH access on port 2222 to a the SSH (22) port of a single LAN-side station. config redirect option target DNAT option src wan option dest lan option proto tcp option src_dport 2222 option dest_ip 192.168.10.20 option dest_port 22 option enabled 1 To test from a WAN-side station (STA1), SSH on port 2222 to a non-existent IPv4 address on the LAN-side network: ssh -p 2222 192.168.10.13 hostname; cat /proc/version When the rule is enabled STA2 will reply with its hostname and kernel version. When the rule is disabled, the connection is refused. The passionate reader will ask “So what netfilter rules does this create?” iptables -t nat -A zone_wan_prerouting -p tcp -m tcp --dport 2222 -m comment --comment "!fw3: @redirect[0]" -j DNAT --to-destination 192.168.10.20:22 ... iptables -t nat -A zone_lan_prerouting -p tcp -s 192.168.10.0/255.255.255.0 -d 192.168.3.185/255.255.255.255 -m tcp --dport 2222 -m comment --comment "!fw3: @redirect[0] (reflection)" -j DNAT --to-destination 192.168.10.20:22 The first rule matches packets coming in the WAN-side if on TCP port 2222 and jumps to the DNAT filter to translate the destination to 192.168.10.20:22. The second rule matches packets coming in from the LAN-side to the WAN-side if on TCP port 2222. The DNAT target uses the same –to-destination parameters as the first rule to find the “reflection” in the conntrack table. The next thought of the passionate reader is “So what is IN the conntrack table?” ipv4 2 tcp 6 117 TIME_WAIT src=192.168.3.171 dst=192.168.10.13 sport=51390 dport=2222 packets=21 bytes=4837 src=192.168.10.20 dst=192.168.3.171 sport=22 dport=51390 packets=23 bytes=4063 [ASSURED] mark=0 use=2 This record shows the WAN-side src=STA1 and dst=192.168.10.13:2222 and the reverse direction LAN-side src=STA2:22 src=STA1. DNAT to translate a LAN-side address on the WAN-side This redirect rule will cause the router to translate the WAN-side source of 1.2.3.4 to the LAN-side STA2 and route the ICMP echo to it. The rule is reflexive in that STA2 will be translated by to 1.2.3.4 on the WAN-side. config redirect option src wan option src_dip 1.2.3.4 option proto icmp option dest lan option dest_ip 192.168.10.20 option target DNAT option name DNAT-ICMP-WAN-LAN option enabled 1 LAN-side public server All redirection requires some form of NAT and connection tracking. For public servers behind the firewall the DNAT target is used to translate the public IP address on the WAN-side to the private address of the server in the LAN-side. Due to the high visibility of a public server, it may warrant putting it/them in a fw3 DMZ. config redirect option target DNAT option src wan option src_dport 25 option proto tcp option family ipv4 option dest lan option dest_ip 192.168.10.20 option dest_port 2525 option name DNAT-MAIL-SERVER option enabled 1 In this example, STA2 is running an email server (e.g. postfix) listening on port 2525 for incoming email. This redirect rule states: any incoming traffic from the wan on port 25, redirect to STA1 port 2525. To verify what is going on dump /proc/net/nf_conntrack to observe the dynamic connnection for incoming traffic. There can be quite a few conntrack records in it so we will search on just the ones using port 2525: ... ipv4 2 tcp 6 7436 ESTABLISHED src=192.168.3.171 dst=192.168.3.11 sport=41370 dport=25 packets=4 bytes=229 src=192.168.10.20 dst=192.168.3.171 sport=2525 dport=41370 packets=3 bytes=164 [ASSURED] mark=0 use=2 ... The connection is coming from STA1 port 25 to the DUT and is translated to STA2 on port 2525 with a response destination to STA1. The relevant traffic matches the DNAT conntrack state which is allowed to traverse zones by OpenWrt firewall, so no extra permissive rules are required. Source NAT (SNAT) The goal of this rule is to translate the source IP address from a real station to a fictitious one on port 8080. config redirect option target SNAT option src lan option dest wan option proto tcp option src_ip 192.168.10.20 option src_dip 192.168.10.13 option dest_port 8080 option enabled 1 To test: use netcat to listen on the STA1, the WAN-side station: nc -l 8080 use netcat to connect on the STA2, the LAN-side station: nc -v 192.168.3.171 8080 Type something on the LAN-side station and see it echoed on the WAN-side station. Check the connection on the WAN-side station using netstat -ntap and see the line: tcp 0 0 192.168.3.171:8080 192.168.10.13:47970 ESTABLISHED 16746/nc The WAN-side station shows the SNAT address connecting to it on port 8080! When used alone, Source NAT is used to restrict a computer's access to the internet while allowing it to access a few services by forwarding what appears to be a few local services, e.g. NTP, to the internet. While DNAT hides the local network from the internet, SNAT hides the internet from the local network. MASQUERADE This is the most used and useful NAT function. It translates a local private network on the LAN-side to a single public address/port num on the WAN-side and then the reverse. It is the default firewall configuration for every IPv4 router. As a result it is a very simple fw3 configuration The LAN-side uses a private network. The router translates the private addresses to the router address:port and the netfilter conntrack module manages the connection. The masquerade is set on the WAN-side config zone option name 'wan' list network 'wan' .... option masq '1' Simple, no? The router will generally get its WAN ip address from the upstream DHCP server and be the DHCP server (and usually DNS server) for LAN stations. The network configuration file defines the private network and the dhcp configuration file defines how the OpenWrt router assigns LAN-side IPv4 addresses. When MASQUERADE is enabled, all forwarded traffic between WAN and LAN is translated. Essentially, there is very little that can go wrong with the MASQUERADE firewall rules. Dump /proc/net/nf_conntrack to inspect the current MASQUERADE connections. The following connection tracks SSH (22) access from STA1 to STA2. ipv4 2 tcp 6 4615 ESTABLISHED src=192.168.3.171 dst=192.168.10.20 sport=60446 dport=22 packets=27 bytes=1812 src=192.168.10.20 dst=192.168.3.171 sport=22 dport=60446 packets=21 bytes=2544 [ASSURED] mark=0 use=2 MASQUERADE supports two or more private LAN zones Transparent proxy rule (external) not tested The following rule redirects all LAN-side HTTP traffic through an external proxy at 192.168.1.100 listening on port 3128. It assumes the lan address to be 192.168.1.1 - this is needed to masquerade redirected traffic towards the proxy. config redirect option src lan option proto tcp option src_ip !192.168.1.100 option src_dport 80 option dest_ip 192.168.1.100 option dest_port 3128 option target DNAT config redirect option dest lan option proto tcp option src_dip 192.168.1.1 option dest_ip 192.168.1.100 option dest_port 3128 option target SNAT This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.OKMore information about cookies Last modified: 2021/02/11 07:58by vgaetera