Na}{

File Content: NAT-HOWTO-5.html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<HTML>
<HEAD>
 <META NAME="GENERATOR" CONTENT="LinuxDoc-Tools 0.9.82">
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <TITLE>Linux 2.4 NAT HOWTO: Controlling What To NAT</TITLE>
 <LINK HREF="NAT-HOWTO-6.html" REL=next>
 <LINK HREF="NAT-HOWTO-4.html" REL=previous>
 <LINK HREF="NAT-HOWTO.html#toc5" REL=contents>
</HEAD>
<BODY>
<A HREF="NAT-HOWTO-6.html">Next</A>
<A HREF="NAT-HOWTO-4.html">Previous</A>
<A HREF="NAT-HOWTO.html#toc5">Contents</A>
<HR>
<H2><A NAME="s5">5.</A> <A HREF="NAT-HOWTO.html#toc5">Controlling What To NAT</A></H2>

<P>You need to create NAT rules which tell the kernel what connections
to change, and how to change them.  To do this, we use the very
versatile <CODE>iptables</CODE> tool, and tell it to alter the NAT table by
specifying the `-t nat' option.</P>

<P>The table of NAT rules contains three lists called `chains': each
rule is examined in order until one matches.  The two chains are
called PREROUTING (for Destination NAT, as packets first come in), and
POSTROUTING (for Source NAT, as packets leave).  The third (OUTPUT)
will be ignored here.</P>

<P>The following diagram would illustrate it quite well if I had any
artistic talent:</P>
<P>
<BLOCKQUOTE><CODE>
<PRE>
      _____                                     _____
     /     \                                   /     \
   PREROUTING -->[Routing ]----------------->POSTROUTING----->
     \D-NAT/     [Decision]                    \S-NAT/
                     |                            ^
                     |                            |
                     |                            |
                     |                            |
                     |                            |
                     |                            |
                     |                            |
                     --------> Local Process ------
</PRE>
</CODE></BLOCKQUOTE>
</P>
<P>At each of the points above, when a packet passes we look up what
connection it is associated with.  If it's a new connection, we look
up the corresponding chain in the NAT table to see what to do with it.
The answer it gives will apply to all future packets on that
connection.</P>

<H2><A NAME="ss5.1">5.1</A> <A HREF="NAT-HOWTO.html#toc5.1">Simple Selection using iptables</A>
</H2>

<P><CODE>iptables</CODE> takes a number of standard options as listed
below.  All the double-dash options can be abbreviated, as long as
<CODE>iptables</CODE> can still tell them apart from the other possible
options.  If your kernel has iptables support as a module, you'll need
to load the ip_tables.o module first: `insmod ip_tables'.</P>

<P>The most important option here is the table selection option, `-t'.
For all NAT operations, you will want to use `-t nat' for the NAT
table.  The second most important option to use is `-A' to append a
new rule at the end of the chain (e.g. `-A POSTROUTING'), or `-I' to
insert one at the beginning (e.g. `-I PREROUTING').</P>

<P>You can specify the source (`-s' or `--source') and destination
(`-d' or `--destination') of the packets you want to NAT.  These
options can be followed by a single IP address (e.g. 192.168.1.1), a
name (e.g. www.gnumonks.org), or a network address
(e.g. 192.168.1.0/24 or 192.168.1.0/255.255.255.0).</P>

<P>You can specify the incoming (`-i' or `--in-interface') or outgoing
(`-o' or `--out-interface') interface to match, but which you can
specify depends on which chain you are putting the rule into: at
PREROUTING you can only select incoming interface, and at POSTROUTING
you can only select outgoing interface.  If you use the
wrong one, <CODE>iptables</CODE> will give an error.</P>

<H2><A NAME="ss5.2">5.2</A> <A HREF="NAT-HOWTO.html#toc5.2">Finer Points Of Selecting What Packets To Mangle</A>
</H2>

<P>I said above that you can specify a source and destination address.
If you omit the source address option, then any source address will
do.  If you omit the destination address option, then any destination
address will do.</P>

<P>You can also indicate a specific protocol (`-p' or `--protocol'),
such as TCP or UDP; only packets of this protocol will match the rule.
The main reason for doing this is that specifying a protocol of tcp or
udp then allows extra options: specifically the `--source-port' and
`--destination-port' options (abbreviated as `--sport' and `--dport').</P>

<P>These options allow you to specify that only packets with a certain
source and destination port will match the rule.  This is useful for
redirecting web requests (TCP port 80 or 8080) and leaving other
packets alone.</P>

<P>These options must follow the `-p' option (which has a side-effect
of loading the shared library extension for that protocol).  You can
use port numbers, or a name from the /etc/services file.</P>

<P>All the different qualities you can select a packet by are detailed
in painful detail in the manual page (<CODE>man iptables</CODE>).</P>

<HR>
<A HREF="NAT-HOWTO-6.html">Next</A>
<A HREF="NAT-HOWTO-4.html">Previous</A>
<A HREF="NAT-HOWTO.html#toc5">Contents</A>
</BODY>
</HTML>

Name	Size	Permission
NAT-HOWTO-1.html	1152 bytes	0644
NAT-HOWTO-10.html	2525 bytes	0644
NAT-HOWTO-11.html	910 bytes	0644
NAT-HOWTO-2.html	4346 bytes	0644
NAT-HOWTO-3.html	1444 bytes	0644
NAT-HOWTO-4.html	4400 bytes	0644
NAT-HOWTO-5.html	5139 bytes	0644
NAT-HOWTO-6.html	8397 bytes	0644
NAT-HOWTO-7.html	1324 bytes	0644
NAT-HOWTO-8.html	1136 bytes	0644
NAT-HOWTO-9.html	2091 bytes	0644
NAT-HOWTO.html	2666 bytes	0644
netfilter-extensions-HOWTO-1.html	2102 bytes	0644
netfilter-extensions-HOWTO-2.html	7807 bytes	0644
netfilter-extensions-HOWTO-3.html	28969 bytes	0644
netfilter-extensions-HOWTO-4.html	12548 bytes	0644
netfilter-extensions-HOWTO-5.html	7041 bytes	0644
netfilter-extensions-HOWTO-6.html	11242 bytes	0644
netfilter-extensions-HOWTO-7.html	2188 bytes	0644
netfilter-extensions-HOWTO-8.html	1021 bytes	0644
netfilter-extensions-HOWTO-9.html	2222 bytes	0644
netfilter-extensions-HOWTO.html	7267 bytes	0644
netfilter-hacking-HOWTO-1.html	7474 bytes	0644
netfilter-hacking-HOWTO-2.html	1718 bytes	0644
netfilter-hacking-HOWTO-3.html	8038 bytes	0644
netfilter-hacking-HOWTO-4.html	53338 bytes	0644
netfilter-hacking-HOWTO-5.html	1056 bytes	0644
netfilter-hacking-HOWTO-6.html	3028 bytes	0644
netfilter-hacking-HOWTO-7.html	9288 bytes	0644
netfilter-hacking-HOWTO-8.html	5234 bytes	0644
netfilter-hacking-HOWTO-9.html	835 bytes	0644
netfilter-hacking-HOWTO.html	3811 bytes	0644
packet-filtering-HOWTO-1.html	1891 bytes	0644
packet-filtering-HOWTO-10.html	2575 bytes	0644
packet-filtering-HOWTO-11.html	3742 bytes	0644
packet-filtering-HOWTO-2.html	1593 bytes	0644
packet-filtering-HOWTO-3.html	5775 bytes	0644
packet-filtering-HOWTO-4.html	2189 bytes	0644
packet-filtering-HOWTO-5.html	1644 bytes	0644
packet-filtering-HOWTO-6.html	3505 bytes	0644
packet-filtering-HOWTO-7.html	35616 bytes	0644
packet-filtering-HOWTO-8.html	1457 bytes	0644
packet-filtering-HOWTO-9.html	2333 bytes	0644
packet-filtering-HOWTO.html	2831 bytes	0644