In this lesson,
we'll look at how we can set up port redirection and network address translation,
which is abbreviated as net.
First, let's explore how port redirection works.
In some cases, we may have some servers on a private internal network.
This network is not directly accessible from the internet.
However,
we can add a publicly accessible server in the middle to get this structure.
The public server is connected to both networks, the internal network at the right
and the internet on the left.
So the private servers on our internal network can now be accessed from the
internet if incoming connections go through this
publicly accessible server in the middle,
but not before going through additional configuration steps.
Because here's the problem at this point,
let's say that some device from the internet contacts our public server
and it asks to connect at port 80 to access a web page.
Now, at this point, our public server would get confused
because it does not know where it should forward this connection to port 80.
What private server on our internal network should deal with port 80 connections.
Should it send it along to private server? 12 or three.
Well, with port redirection also called port forwarding,
we can solve this problem.
We can create rules that tell our public server where
to redirect incoming connections to port 8993 and 306.
In this case,
anything incoming on port 80 will be redirected or forwarded to server one,
port 993 connections would be forwarded to server
two and port 3306 connections to server three.
Now let's move on to network address translation.
When data is sent through networks,
it's first encapsulated in what are called network packet.
For example, when we watch a video on youtube,
this data is sent to us in very small network packets.
Each containing a portion of that video.
Besides the data itself,
each network packet also includes the source
IP address and the destination IP address.
This identifies who sent the packet and who should receive it.
An IPv4 packet includes the stuff we see here.
Mostly things that computers and programs need to
make sense of what they send and receive.
But the important parts that we will use in this lesson are the source address
and the destination address that we see encapsulated in the middle of this diagram.
Data on the internet is passed from server to server router to
router switch to switch until it finally arrives at a destination.
So having the source and destination addresses encoded in the network packets
helps every device in this chain know where to forward network data,
but also know where to return a response.
Now,
let's think of our previous example with the three servers on a private
network and one server connected to both the internet and this private network.
We can imagine a device on the internet that has an IP like 203.0 0.0 0.113 0.1.
Now it sends some data to our public server.
So 20301131 will be encoded as a source
address in our network packet that's sent out.
And the destination address will be the IP of our public server. Let's say 1234.
When the public server gets a network packet on port 80
it knows it has to forward it to private server one.
So what our public server does is change the
destination address to the IP of private server.
One,
the destination address 1234 is replaced with 10.0 0.0 0.5.
Now server one sees this network packet matches its own IP in the destination field.
So it will accept it
up to this point. Our public server just changed the destination address,
but it might have to go one step further
because the device from the internet that sent
this network packet had an IP of 2030113.1
which means that 20301131 is still encoded as a source address.
Private server one did successfully receive this packet.
But when it will try to send some data back,
it will fail because it will attempt to send back to the source address 2030113.1
and private server one is not connected to the internet.
So it can't send data to that IP
to solve this issue, our public server can replace the source address as well.
Instead of keeping 2030113.1 as a source address,
it can replace this with its own IP 1234.
This way, when private server one tries to respond to the forwarded network packet,
it will see that it has to send this back to our public server at 1234.
And since it's able to reach our public server,
the operation will be successful this time.
And with some additional nap magic,
our public server can even return this response to the original sender
when a machine manipulates the source or senders' IP like this,
it's effectively pretending to be someone else.
That's why this technique is also called masquerading.
In this case, when it's replacing 20301131 with its own IP address 1234.
It's effectively pretending to be that device from the internet,
sending a message to our private server.
As far as our private server is concerned,
it will have no idea who the original sender was.
But through NAT done in both directions,
our public server will remember who sent what and where network packets need to go.
It's the same thing that our routers at home do when data is coming in on a router.
It just knows what it should send to our
smartphone and what should be sent to our laptop.
This is also done through network address translation and masquerading.
Now, let's see how we can set up port redirections in Linux.
The first thing we'll need to do is enable IP forwarding on our machine.
Since port redirection needs our machine to be able to forward network packets.
And this is usually disabled by default
on
Ubuntu. We can enable this by editing one of two files, either Etsy Sis ctl.com or
Etsy sis CTL dot D 99 sctl.com.
If possible, choose the second option.
Editing Etsy Sis ctl.com is riskier because future updates to system packages
might modify this file and we can end up losing our changes
and we'll notice these lines
if we uncomment. The first one, we will enable IPv4 forwarding
and uncommenting. The second one enables IPv6 forwarding.
After we save changes to this file,
we must reload all CCTL config files with this command.
The dash dash system parameter tells the CIS CTL command to
look for configuration values in all the system default files and directories
to check if our change took effect, we can run this command.
And in the output, we should check to see if both of these values are set to one.
Now, how do we set up port redirection?
Well, first of all, all network data is initially handled by the Linux kernel.
So that means that every firewall rule,
every redirect, every network address translation is handled by the kernel as well
or at least by part of it
called the Netfilter framework.
And we have various commands to inform this framework
about how we want it to process network packets.
Now, the modern command to interact with the Netfilter framework is NFT.
Unfortunately,
the NFT commands that we'd need to use to set
this up are quite hard to remember without using Google.
So in our examples, we'll use another command called iptables.
This is the predecessor of NFT,
but it still works on modern distributions.
In fact,
most distributions are set up in such a way
that iptables rules are automatically translated into NFT rules.
So even if we use the older command, things will still work as expected.
Now, let's imagine this scenario,
we want to redirect every request coming in from the 10 000 slash 24
CIDR range.
All data incoming from that network to port 8080 on this machine should be
redirected to port 80 on a remote server with the IP address of 19216805.
Before we set this up, we'll want some additional data though,
namely what network interfaces will be responsible for this redirection.
Let's assume a scenario where two network cards are involved.
One deals with the incoming traffic from the 10 000 24 network
and another deals with the outgoing traffic to 19216805,
which sits on a different network.
We can inspect our network addresses with an IP A command
and we might see something like this.
Now,
this tells us that ENP six S zero deals with
the outgoing traffic that will be redirected to 19216805.
And ENP one S zero deals with the incoming traffic from 10 000 slash 24 network range.
But in some cases, we might need to do a redirect to an external network.
Imagine redirecting to 1234.
This doesn't fit into any of the network ranges above.
It's not on 19216800 slash 24
or on 10 00 slash 24.
So in that case, we can use a different trick,
we can just look at the route set up for the machine with this
IP
R. And in the output, we search for the default route,
we might see a line like this
default via IP address.
This tells us that all network packets to
external networks are sent through this default gateway.
And we can see the device used is ENP one S zero.
So we can conclude that ENP one S zero will be used
to send data to 1234 when configuring our port redirection rule.
Now let's get back to our example where ENP one S zero is connected to the
10 000 slash 24 network and ENP six S zero should forward requests to 19216805.
Now that we have all the data we need, let's set up this redirect.
The first thing we should know though iptables
uses structures known as tables and chains.
Here's a simplified diagram
as a network packet comes in or goes out, it travels through certain chains
and it's processed according to rules added in those chains.
For example, right before a network packet goes out through a network card,
it passes through a postrouting chain.
Now you can think of an iptables chain in
terms of when the network packet is processed.
And you can think of tables as a way to group rules for a certain purpose.
A table can reference multiple chains but those chains will only
be triggered during a certain time of the network packets journey.
Now let's see the command. We need to set up our port redirect rule.
We'll type pseudo iptables followed by the parameters we want
dash T stands for table with dash T NAT. We add this rule to the NAT
table
when a port is redirected network address translation is used to change
that initial destination IP and port to a different IP import.
So whenever we need NAT,
we need to add our rule to the NAT table dash
A is the option for a pin with dash A prerouting.
We append another rule to the prerouting chain which deals
with the altering network packets as soon as they are received
because the IP address will be modified.
So this modification was to happen before the routing stage.
Otherwise,
the packet will be routed to the wrong place based
on the old IP address instead of the new one.
And dash I stands for input
with dash IENP one S zero. We select ENP one S zero as the input interface.
This way we only apply this rule when the packet is received on a specific interface.
Next with the dash S option, we pick up the source IP.
So we apply this rule only if the source IP
matches anything in the 10 000 slash 24 network range.
Another way to say that is we only redirect this packet.
If it comes from an IP in that range
with dash P, we set the protocol to TCP.
Another typical value we could use here is UDP to add the rule for the UDP protocol.
It's mandatory to use this dash P option for
a port redirect rule without using dash P.
We'd get an error that says DPORT is unknown option
using DPORT requires dash P as well
to set up a rule for both protocols, just copy and paste the same command.
And in one use dash P TCP. While in the other use dash pu two
P and keeping all the other options,
the same DPORT sets the destination port to 8080.
Meaning this redirect should happen when we receive
packets on the 8080 port of this machine.
And the dash J option is where the magic happens.
Dash J tells our rule to jump this network packet to a so-called target.
In iptables terminology,
you can think of it as sending this network packet
to a mini program or a mini module of sorts.
In
this case, it's sent to an extension called
DNAT
short for destination NAT.
This is the target extension that alters the packet
to be redirected to a new IP in port.
Finally to destination is an option that we pass to the DNAT extension.
So this option has to be added after the dash J DNAT option.
Here, we simply instruct the
DNAT extension to redirect this packet to the
19216805 IP address and port 80 of that machine
at this point,
any external packet coming to port 8080 on our machine
will be forwarded to this remote server on port 80.
Please note that if you want to test this,
the redirect only works when connecting from an external machine.
It does not work. If you connect from the same machine,
the prerouting chain only applies to packets received from the outside world.
But even if we connect from an external machine,
we'd notice the connection is initiated.
But then it hangs.
Which makes sense
because even though network packets are forwarded, they have no way of coming back.
If an IP like 10 009 sends something to our server on port 8080
it will reach 19216805 on port 80. But 19216805 would see that 10 009 sent this.
When it tries to send the data back,
it won't be able to reach the 10 00 slash 24 network.
So we need an additional command for our server to step in and solve this issue.
We need to tell it to pretend that the data it's redirecting isn't coming from 10 009,
but rather its own IP address like 19216801,
which means that when it passes the data along to 19216805,
then that server will be able to return a response
because it knows how to contact our server at 19216801.
Since they share a common network.
Now, our server receives that response and passes it back to 10 009
table once again. But this time with dash A, we won't append to the prerouting chain
but to the postrouting chain which deals with altering network
packets just before they leave the network with dash S,
we do the same thing as before and apply this rule only if the
source IP that sent this packet falls within this 10 000 slash 24 range.
And what's important to note with dash O this time,
we select the output interface not an input
interface as we did with the redirection rule
namely ENP six S zero, which is used to send out network packets.
An easy way to remember.
This difference is that in prerouting,
you add the network interface that receives the packet.
And in postrouting, you add the interface that sends out the packet.
Finally,
we add the dash J option to jump or
send this network packet to the masquerade extension.
This time
note that we don't need to specify the IP of our server.
It will do its nap magic and replace the source IP with its own IP dynamically.
It will simply look at what IP it has to use to send this network packet out
and replace the initial source IP of the packet with its own IP address.
As you can see these iptables commands can get a bit complex.
But here's a contrast with NFT.
But in a real scenario, you want to use these to limit who can forward what
otherwise your machine can be abused by anyone on
the internet since it will forward network data unconditionally.
In fact,
you may want to apply additional firewall rules to limit
network forwarding even more and prevent misuse from unauthorized devices.
Here's a quick example of what we could do to further lock this down
when enabled, the default behavior of UFW is to disallow any kind of forwarding
so we can run something like this.
First,
we would allow SSH traffic to port 22 then enable the firewall and finally add a
route rule to allow network packets to be
forwarded from the 10 000 slash 24 network range
to the 19216805 IP address.
Another thing worth mentioning is that in some cases,
the input and output network interface can be the same one.
So you can have the dash IENP one S zero in the
first command and dash OENP one S zero in the second one.
Or you can simply omit mentioning input and output interfaces.
Omitting them means the redirect rule will be applied no
matter what interface receives or sends the network packet,
which is not ideal in a real scenario, but good enough for experimental purposes.
If you forget the correct iptables commands,
here's a way that you can get a quick reminder.
You can consult the manual for a
Boos uncomplicated firewall framework
by typing in man UFW framework
and you scroll down to the full example section. You'll notice this,
the first two lines basically reflect the first command. We use,
the backslash escapes a new line character or in plain terms.
This is actually a single list of options but
separated on two different lines by that backslash.
But we can remove that character in our future command
and put all those options on a single line.
So just add pseudo iptables dash T net in front of this line,
move the two destination line to the same line and you get two here,
then add the dash s option before the DNAT extension
to select a source IP for the rule,
modify the dash I interface DPORT and two
destination IP and port to whatever you need.
And then you can start over configuring networks
and firewalls is usually something most beginners struggle with
and it's understandable as it is a very complicated and vast subject.
So I hope this lesson cleared up at least some of the mysteries behind iptables,
port, redirection and network address translation.
Now let's jump to our next lesson.