Building a Linux Dial-up Server, Part 1 - Page 3

Configuring NAT

Once your dial-up server can connect to an ISP, the next step is to enable other hosts on your LAN to share the connection. Presumably your LAN is up and running, and all the machines can ping each other. If not, well, we're going to move ahead without you. Please catch up when you can.

iptables takes care of sharing an Internet connection quite nicely. Here is a simple recipe:

# modprobe iptable_nat
# iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
# echo "1" > /proc/sys/net/ipv4/ip_forward

These can be run from the command line or nicely ensconced in a script. The first line loads the NAT kernel module. The second line turns on masquerading. The third line turns on forwarding, which is commonly disabled in the kernel by default. WARNING: There is absolutely zero security in this! None! Do not use this alone! Please see Resources for links on building a firewall. "Linux IP Masquerade HOWTO" is especially useful for this.

To see which netfilter/iptables modules are installed on your system, try:

# grep netfilter /lib/modules/`uname -r`/modules.dep

Note that `uname -r` is surrounded by backticks, not apostrophes. The backtick key should be the lowercase of the tilde, next to the number 1 key on the top row. This demonstrates a lovely feature of the bash shell -- command substitution. To see what kernel modules are loaded, run good ole lsmod.

Well that's enough for today. In part 2 we'll create a dial-in server and set up dial-on-demand.

Resources

Linux PPP HOWTO
Freesco
wvdial
How to hook up PPP in Linux
Linux IP Masquerade HOWTO

» See All Articles by Columnist Carla Schroder