Linucate
~ Linucate_

212.1 Configuring a router

All Levels

Introduction

A Linux router forwards packets between networks and often applies filtering or IPv4 NAT. Routing decides where packets go; firewall rules decide whether and how they are allowed.

What you should be able to do after this lesson:

  • Enable IPv4 and IPv6 forwarding.
  • Read and change routing tables.
  • Write stateful packet-filter rules.
  • Configure SNAT, masquerading, DNAT, and port forwarding.
  • Save and restore firewall policy without locking yourself out.

Big Idea: Trace the Packet Through Independent Decisions

For transit traffic, follow this path:

ingress interface -> route lookup -> FORWARD filtering -> optional source NAT
-> egress interface -> return route -> reverse state/NAT -> client

Forwarding, routes, filter rules, and NAT must all agree. A successful DNAT rule can still fail because the FORWARD chain drops the translated packet or the destination lacks a return path.

Enable Forwarding

sudo sysctl -w net.ipv4.ip_forward=1
sudo sysctl -w net.ipv6.conf.all.forwarding=1

Persist required settings below /etc/sysctl.d/. Forwarding alone does not create routes or firewall policy.

Address Ranges

Private IPv4 ranges are:

  • 10.0.0.0/8
  • 172.16.0.0/12
  • 192.168.0.0/16

IPv6 Unique Local Addresses use fc00::/7, while link-local addresses use fe80::/10. IPv6 is normally routed end to end rather than hidden behind NAT.

Filter Tables and Chains

Classic iptables filter chains include INPUT, OUTPUT, and FORWARD. Router transit traffic crosses FORWARD.

iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i lan0 -o wan0 -j ACCEPT
iptables -A FORWARD -j DROP

Rule order matters. Inspect counters:

iptables -L -n -v --line-numbers
ip6tables -L -n -v

Source NAT and Masquerading

For a changing public IPv4 address:

iptables -t nat -A POSTROUTING -o wan0 -j MASQUERADE

For a stable translated address, SNAT can state it explicitly. NAT changes addresses; it does not automatically define all filter permissions.

Destination NAT and Port Forwarding

iptables -t nat -A PREROUTING -i wan0 -p tcp --dport 8443 \
  -j DNAT --to-destination 192.168.10.20:443
iptables -A FORWARD -p tcp -d 192.168.10.20 --dport 443 \
  -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j ACCEPT

The internal host needs a return route through the translating router.

/etc/services maps familiar service names to port and protocol numbers. Firewall tools can accept some names, but numeric output is usually clearer during troubleshooting because it avoids local name-resolution ambiguity.

Safe Policy Changes

When administering remotely:

  1. Keep an established recovery session.
  2. Schedule an automatic rollback.
  3. Add required management permits before changing defaults.
  4. Apply and test from another connection.
  5. Persist only the verified rule set.

Use distribution tooling or iptables-save and iptables-restore for persistence. Modern systems may implement iptables commands through an nftables backend, but LPIC-2 4.5 explicitly tests iptables concepts.

Guided Practice: Verify a Forwarded Flow

Build the lab with three network namespaces or virtual machines: client, router, and server. Use documentation ranges and separate subnets. Before NAT, prove that the router has one address in each subnet and that both endpoints route through it.

Enable forwarding and add only stateful forwarding rules. Capture on both router interfaces:

sudo tcpdump -ni <lan-interface> host <client-or-server>
sudo tcpdump -ni <wan-interface> host <client-or-server>

Inspect counters after each test:

iptables -L FORWARD -n -v --line-numbers
iptables -t nat -L -n -v --line-numbers
ip route get <destination>

Add masquerading only if the addressing design requires it. Explain which source address the server should observe before running the test.

Troubleshooting Scenario

A DNAT rule forwards public TCP 8443 to an internal HTTPS server. The NAT counter increases, but the server never receives traffic. The FORWARD policy is DROP and has no matching permit.

Add a narrowly scoped stateful forwarding rule, verify the server's return route, and inspect counters on both directions. Repeating the DNAT rule would not bypass filter policy.

Exam Focus

  • Know IPv4 private, IPv6 ULA, and IPv6 link-local ranges.
  • Distinguish routes, IP forwarding, filter chains, SNAT/MASQUERADE, and DNAT.
  • Write rules by source, destination, protocol, port, interface, and connection state.
  • Save and restore IPv4 and IPv6 policy with a remote-access rollback plan.

Recap

  • Routing, forwarding, filtering, and NAT are separate functions.
  • Transit traffic uses the FORWARD chain.
  • Stateful rules permit return traffic without opening every inbound connection.
  • Remote firewall changes require a tested rollback path.
🎯

Test Your Knowledge

Complete the quiz to assess your understanding of this course's concepts.

Back home