linuxexpert-practice-labs/labs/linux-plus/3-2-3-nat-and-forwarding/README.md

Linux+ 3.2.3: NAT and IP forwarding

Turning this VM into a router for a private network with firewalld zones, a policy and masquerading.

Before you start

RHEL family only. The peer, at 10.99.0.2, stands in for the Ubuntu VM. It sits on this VM's second network, 10.99.0.0/24 (this VM is 10.99.0.1 there, on interface le-host), and its default route already points at this VM, but it has no way out yet: from the peer, ping -c 2 9.9.9.9 fails. Get a shell there with sudo ip netns exec lepeer bash.

The lab installs and starts firewalld, allowing SSH. The interface le-host isn't managed by NetworkManager, so set its zone with firewall-cmd rather than nmcli. Keep a console open: a firewall mistake can cut off SSH.

Tasks

1. Put le-host in firewalld's internal zone, persistently.
2. Create a firewalld policy int-to-pub that accepts traffic from zone internal to zone public, and turn on masquerading in the zone of the main interface, both persistently. Check net.ipv4.ip_forward.
3. From the peer, ping -c 2 9.9.9.9 now works. Watch the translation on this VM with tcpdump -ni any icmp while it runs.

Hints

• firewall-cmd --permanent --zone=internal --change-interface=le-host, --get-active-zones.
• firewall-cmd --permanent --new-policy NAME, then --policy NAME with --add-ingress-zone, --add-egress-zone and --set-target=ACCEPT (firewalld 2.4 takes one of these per command); --info-policy NAME.
• --zone=public --add-masquerade, with --permanent too; --reload.