Hey everyone and welcome back. So now what I want to talk to you about is this concept
we briefly addressed or rather mentioned should I say not quite addressed and that is called
NAT Network Address Translation. Now this is a very, very important concept in the world
of networking and the internet and it is a functionality that we can actually invoke with
respect to IP tables. So before we actually see the example of how to actually make the
configuration on the command line, let's just briefly talk about what it is exactly we are
doing. So here is the deal. You may recall from your LPIC One Studies, we have something
called Private IP Addressing. So these are addresses that are meant to be used on your
own network, your local network that you happen to control, i.e. you cannot actually route these
addresses on the public internet. As the name suggests, these addresses are supposed to be
private. Now conversely, we also have public IP addresses. Now you can imagine what these
addresses are for. These are designed to be used. That is, they can be used and rooted
over the public internet. Now these two concepts, the idea that we have private IP Addressing,
as well as public IP Addressing is right at the heart of Network Address Translation.
So what exactly am I talking about them? Well, here are our private IP address ranges. Okay,
recall, we have our class A range, which is 10, 0, 0, 0, all the way up to 10, 255, 255, 255. Any IP
address within this range here is going to be deemed as a private IP address. If you try to route
this out in the public internet, those routers are going to filter those IP addresses and they will
not be allowed to be advertised. So that is one range. The next range, we have our 172, 16, 00,
all the way to 172, 31, 255, 255. Again, anything within this range is going to be deemed a private
IP address. And lastly, we have the very well known 192, 168, 00, all the way to 192, 168, 255,
255, and I'm running that space here. But nevertheless, you get what I'm talking about.
These three ranges are our private IP addresses. Now the good thing, because these addresses cannot
be routed on the public internet, what this means is that they can be reused internally. So think
about it like this. Let's imagine we have our private little network here. This could be owned by me.
Let's say I'm using the address range of 10, 000, 0, 0, slash 8, and I have a connection to my ISP.
And let's say attached to the same ISP is another network entirely owned by a completely different
company. Now the cool thing is, is that that company can also use the same IP addressing
internally. They could also use 10, 000, slash 8. Now, if the people inside this network here
want to talk to the people inside, say for example, this network, we might have a little bit of a
problem as it stands right now, because there seems to be some type of IP address duplication.
What if someone in this network here has an IP address of 10, 005? Okay, so someone over here
wants to reach that device here and they try to send a request to 10, 005. Well, the devices inside
of the network are going to try to find this device within this network because it's in the same
network range. Does that make sense? Now the reality is this type of setup is actually very,
very common in that we are reusing IP addressing. But the cool thing is we do not have any such
problems. The reality is, is because we actually invoke network address translation,
and this is going to solve this very problem. Let's look at it like this. Let's imagine we have
our local network, like I say, it'd be 10, 000, 0, slash 8. And our default gateway, let's just say,
is this little router here, okay? Now this router here is not just going to have an interface here,
which is connected to the inside internal network. It's also going to have a front facing,
a public facing interface here, which could be connected to my actual ISP. Okay, let's just say
that. Now this outside facing interface, this is actually going to have a public IP address. And
this interface here is going to have a private IP address. Now, what is going to happen is that all
of the devices within this network, which are using private IP addresses within this particular
range, when they try to reach a network which is outside of the local network, like a remote network,
when they actually send their traffic out, and it goes out through this line here and into the
default gateway, the default gateway is going to translate that private IP address and actually
change it so that it is the public facing IP address, in effect, translating it. And this
can be the same for every single device. That means that every one, all the thousands of devices
within this private IP address range, all within here, they can all share the same singular public
IP address on the edge of the default gateway here. So now it doesn't actually matter if two
different networks happen to be using the same IP addresses internally, when they go to speak to
networks which are not theirs, they happen to be using unique globally identifiable IP addresses,
and it's invoked using network address translations. And that really is the crux of the technology. It's
going to allow us to hide away the details of the private IP addressing within the internal network,
because external users will not see actually the private IP addressing you're using. They will
only see the public globally rootable IP address, and we don't have to worry about buying lots of
IP address spaces for all of our devices. Instead, we can just keep reusing private IP addressing and
invoke that to do the translation at the very edge. So this idea of private IP addressing and public
IP addressing, as well as say, an internal interface and an external interface, these really are crucial
to the configuration of network address translation. So let's briefly look at how the actual
configuration can be done then. So what I will do here is I will just clear my screen. So let's just
imagine that our Ubuntu server is going to have an internal interface called eth0, which could be used
for its private IP addressing. And its external address is going to be on eth1, which will be the
external interface. So all the private network will be attached here, and any public facing
services such as our connection to our ISP or some other global network will be on this interface.
So when we are setting that on a router using IP tables, we want to do so by specifying the
internal interface. That is the one that faces the local network. So again, in our example,
we're going to pretend we have both interfaces here, eth0 would be the internal network. Let me show
you what the actual configuration is that you have to remember for the examination. Okay, so the
actual command that you can use to set up NAT on a router using IP tables is simply going to be IP
tables. And then we're going to say T for the table. Now remember, we can have a filter table,
or we can have a NAT table or a mangle table. What I'm going to choose is the NAT table. Then
I'm going to use the dash capital A option. And after that, I'm going to specify a particular chain.
Now the chain I want to target here is going to be the post routing chain. So I will say post
routing. I'm going to say dash O for outgoing packets. So these are packets coming in on the
internal interface going in the outward direction because we are leaving the network.
And I'm going to specify eth0 because that is my internal interface. And to just invoke NAT,
I want to say dash J and then masquerade. And this is the command that we have to remember for the
purposes of the examination with respect to our NAT configuration. We will use IP tables, we'll
specify the table we want to use, which is NAT. We want to append to the post routing chain. We
have traffic bound for the outside coming in on the eth0 interface. And we ultimately want to
masquerade our IP addressing by presenting it as the globally rootable public IP address on the
outside interface. And this is going to allow us to invoke NAT on our device configured to be a
router. So now that we've seen some IP table configuration using NAT, let's see the same
type of thing just doing some basic firewall packet filtering. So let's say I wanted to
drop packets that were coming from the 17 to 16,00 network. What I could say is the command
IP tables and I should actually add that this should actually be used or ran as the root user.
So I really should say pseudo IP tables. The table I'm going to use is not going to be NAT. We're
going to use the filter table. I want to append to the input chain. This would be packets
destined for us locally as the endpoint. And we could say sourced from 17 to 16,00
slash 16, which would be the network. And what we actually want to do is we want to drop that
particular packet. So if anyone sends a packet from this particular address range for our IP
address as its destination, IP tables is just going to drop that packet. I type in my password
and now that rule is in play. Now if I actually wanted to see the rules for that particular
filter chain, I could say pseudo IP tables, table is going to be the filter table. And I want to
list everything I have on my input chain. And now we can actually see the rule that we have put
in play. And the reality is you can get very, very creative with these rules. Like I say,
you can change the input chain to be the output chain. We can change the table from filter to NAT.
Like we saw, or we could use the mangle table. If you want to modify some type of IP headers,
we could change the action from masquerader drop to something like say accept or to log.
And we can not just specify source addresses by saying dash s, we can do dash d for destination
addresses or destination networks. We can also specify particular protocols or particular
port numbers that we want to either allow or deny access to. Say for example, I have said
pseudo IP tables, I will choose the filter table once again, let's append to the input chain. So
for things coming in towards us, this time I'm going to specify the protocol of ICMP, which is
used for ping request. And what I want to do is either I could accept them, or once again, I could
drop them, let's maybe just say accept for a little change. And we will again look at our
configurations. If I hit enter, we can now see that I am now accepting any ICMP ping messages
whilst still dropping packets coming from this particular network. So as we can see here with
IP tables, we can do a lot of powerful stuff. The reality is these examples don't even begin
to scratch the surface of what you can do. But really for the purposes of the examination, try to
focus in on those different tables, the different chains, how we put rules together, what our targets
may be, such as dropping or accepting, understand what NAT is and how we can invoke NAT using IP
tables by specifying the NAT table. Or if we want to invoke some type of packet filtering as a firewall,
we can invoke the filter table and construct rules based on this type of syntax that we're seeing
right here. Okay, so that is us for our introduction into using IP tables. I hope this has been
informative for you and I'd like to thank you for viewing.