Unnamed

This is what I would use to NAT outbound traffic, eg, if I were using a Linux box as a firewall.


-----8<-------------------------------
# Set localtion of iptables
IPTABLES=/sbin/iptables

  # Flush tables
    $IPTABLES -t filter -F
    $IPTABLES -t filter -X
    $IPTABLES -t nat -F
    $IPTABLES -t nat -X


  # Set policies
    $IPTABLES -t filter -P INPUT DROP
    $IPTABLES -t filter -P OUTPUT DROP
    $IPTABLES -t filter -P FORWARD DROP

  # Enable IP forwarding
    echo "1" > /proc/sys/net/ipv4/ip_forward

  # Enable Dynamic IP
    echo "1" > /proc/sys/net/ipv4/ip_dynaddr

  # Allow from local to local
    $IPTABLES -t filter -A INPUT -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT
    $IPTABLES -t filter -A OUTPUT -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT





###### LOGGING ######
  # Note: Enabling this will log EVERYTHING and quickly fill up disk space.
#    $IPTABLES -A OUTPUT -j LOG
#    $IPTABLES -A INPUT -j LOG
#    $IPTABLES -A FORWARD -j LOG






###### NAT RULES ######
# IP Masquerading rather. For hiding a LAN on eth1 behind eth0 ip

  # First set set default policies
    $IPTABLES -t nat -P PREROUTING ACCEPT
    $IPTABLES -t nat -P POSTROUTING ACCEPT
    $IPTABLES -t nat -P OUTPUT ACCEPT

  # In this case eth0 = external
  # eth1 = internal network on 192.168.100.0/24
    $IPTABLES -t filter -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
    $IPTABLES -A FORWARD -i eth1 -s 192.168.100.0/24 -j ACCEPT
    $IPTABLES -A FORWARD -i eth1 -j DROP
    $IPTABLES -t nat -A POSTROUTING -o eth0 -j MASQUERADE
-----8<-------------------------------






# iptables -L -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
[root@admin ~]# iptables -t nat -L -n
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
DNAT       tcp  --  0.0.0.0/0            1.1.1.1        tcp dpt:80 to:2.2.2.2

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
MASQUERADE  all  --  0.0.0.0/0            0.0.0.0/0

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination