Network adapters
In this specific configuration
- the WAN side (ISP router) is connected to
eth1; the router sets the IP192.168.0.100related to its MAC address - the LAN side (switch) to
eth0
Check the current state
BASH
ip -c a
If any eth interface is identified as DOWN, bring them up with that command
BASH
sudo ip link set eth0 up
Configure each adapter
BASH
sudo nano /etc/network/interfaces.d/eth0
INI
auto eth0
iface eth0 inet static
address 192.168.10.1
netmask 255.255.255.0
BASH
sudo nano /etc/network/interfaces.d/eth1
INI
auto eth1
iface eth1 inet static
address 192.168.0.100
netmask 255.255.255.0
gateway 192.168.0.254
Restart the network service
BASH
sudo systemctl restart networking
Port-forwarding and internet routing
Edit persistent network parameters
BASH
sudo nano /etc/sysctl.conf
Set an IPv4-exclusive port-forwarding
INI
net.ipv4.ip_forward=1
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.eth0.disable_ipv6 = 1
net.ipv6.conf.eth1.disable_ipv6 = 1
Edit low-level UFW rules
BASH
sudo nano /etc/ufw/before.rules
Define a *nat section at the top of the file
INI
# NAT Masquerading (allows LAN devices to reach internet)
*nat
:POSTROUTING ACCEPT [0:0]
# Masquerade for eth1
-A POSTROUTING -s 192.168.10.0/24 -o eth1 -j MASQUERADE
COMMIT
And at the end of the file
INI
# Allow forwarding between LAN and WAN
-A ufw-before-forward -i eth0 -o eth1 -j ACCEPT
-A ufw-before-forward -i eth1 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
# don't delete the 'COMMIT' line or these rules won't be processed
COMMIT
Add a file
BASH
sudo nano /etc/sysctl.d/99-ipforward.conf
With this content
INI
net.ipv4.ip_forward=1
Apply immediately
BASH
sudo sysctl --system
Updating UFW
BASH
sudo nano /etc/default/ufw
Edit this line
INI
DEFAULT_FORWARD_POLICY="ACCEPT"
Allow LAN devices communicating with the gateway
BASH
sudo ufw allow in from 192.168.10.0/24 to 192.168.10.1
And reload the firewall
BASH
sudo ufw reload