iptables firewall and routing

Hi there,

I can try and help you outline a simple iptables configuration that should achieve what you’re looking to do.

1. Firstly, you’ll need to enable IP forwarding on your Linux router.

   echo 1 > /proc/sys/net/ipv4/ip_forward
   

   To make this change permanent, edit the file /etc/sysctl.conf and set net.ipv4.ip_forward=1.

2. Set up iptables rules: Here are the iptables commands you would use:

   First, flush (delete) all existing rules:

   sudo iptables -F
   

   Then, set the default policy to ACCEPT for all chains:

   sudo iptables -P INPUT ACCEPT
   sudo iptables -P OUTPUT ACCEPT
   sudo iptables -P FORWARD ACCEPT
   

   Now, to enable NAT (Network Address Translation) so that your internal networks can share the external IP address, you’d use a rule like this:

   sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
   

   To forward incoming web traffic on port 443 to port 5656:

   sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to-destination 192.168.6.100:5656
   

   To allow internal communication on port 3136:

   sudo iptables -A INPUT -i eth1 -p tcp --dport 3136 -j ACCEPT
   sudo iptables -A INPUT -i eth2 -p tcp --dport 3136 -j ACCEPT
   

   Note that this is a very basic setup, and in a real-world scenario, you’d probably want to tighten up the security settings considerably. You should limit which IPs can connect to certain ports, drop invalid packets, etc.

3. Configure routing: If your Linux box doesn’t know how to route packets between your networks, you may need to add static routes. You can add routes with the route command. However, in your case, since all the subnets are directly connected to your Linux box, routing should not be required.

Best,

Bobby