Creating Ubuntu 18.04 Masquerade

Prerequisites

Ubuntu 18.04.5 Installed
Updated Operating to current patch level
Both iptables-persistent & netfilter-persistent packages

System Details

Ubuntu 18.04.5
Internet interface: eno1
Ubuntu 18.04.5 IP Address: 10.160.5.107 <-- we use the host IP as the gateway on all clients wanting Internet.

Update Ubuntu 18.04

$ sudo apt update && apt upgrade -y

Configuration

Edit /etc/sysctl.conf and insert the line below for IP forwarding

$ sudo vim /etc/sysctl.conf

Add below line inside sysctl.conf like example below

net.ipv4.ip_forward=1

Apply the settings by typing the below command

$ sudo sysctl --system

Startup Requirements

You must have an idea of which interfaces you want to route traffic through for the masquerade.

Please see command below for Masquerade Command reference.

Installing Software

Install the software by typing below commands

$ sudo apt install -y iptables-persistent netfilter-persistent

Masquerade Commands

The server or machine that will provide internet to other client machines. The active interface we specified below is where the host get it's active Internet from which is eno1 interface.

iptables -t nat --append POSTROUTING --out-interface eno1 -j MASQUERADE
iptables --append FORWARD --in-interface eno1 -j ACCEPT

You can usually find the active internet interface by using the route command with the -n switch. The example below shows gateway is 192.168.0.1 using interface eno1 just like we have in our iptables commands above.

$ route -n

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.0.1     0.0.0.0         UG    600    0        0 eno1
10.158.254.0    0.0.0.0         255.255.255.0   U     0      0        0 pan1
172.16.111.0    0.0.0.0         255.255.255.0   U     0      0        0 vmnet8
192.168.0.0     0.0.0.0         255.255.255.0   U     600    0        0 eno1
192.168.64.0    0.0.0.0         255.255.255.0   U     0      0        0 vmnet1
192.168.122.0   0.0.0.0         255.255.255.0   U     0      0        0 virbr0

Save & Apply iptable rules

$ sudo netfilter-persistent save && sudo netfilter-persistent start

Enable the rules during startup using below command for every boot.

$ sudo systemctl enable netfilter-persistent

Client Machine Setup

The client machine is the machine on the same network as the masqueraded server machine that needs access through the host machine to get Internet.

The below netplan configuration is an example of how you should setup IPv4 gateway.

# This is the network config written by 'subiquity'

network:
  version: 2
  ethernets:
    ens3:
      dhcp4: true
    ens9:
      dhcp4: no
      gateway4: 10.160.5.107
      addresses:
              - 192.168.0.5/24
      nameservers:
              addresses: [1.1.1.1, 1.0.0.1]

The above netplan example shows we specified the gateway4: parameter with the hosts IP as the gateway.

How do you feel about this post?

Tags: