Take the 2-minute tour ×

I need to make a quick-and-dirty NAT out of a Ubuntu 10.10 box. Just "this side is NATted with DHCP handing out 192.168.x.0/24" and "this side gateways to the Internet", and nothing else interesting. There seems to be many choices with varying degrees of documentation. What's the easiest way to do this?

share|improve this question

2 Answers 2

up vote 2 down vote accepted
echo "net.ipv4.ip_forward=1" >> /etc/sysctl.d/10-network-security.conf
iptables -t nat -A POSTROUTING -s -o externaleth -j SNAT --to externalip
apt-get install dhcp3-server
gedit /etc/default/dhcp3-server
interfaces="internaleth1" #eth2 or eth3 or whatyouhave :D
gedit /etc/dhcp3/dhcpd.conf
subnet netmask {
    option routers        ; #yours itnernal ip
    option subnet-mask    ;

    option domain-name              "mylan.com";
    option domain-name-servers;

apt-get install dns-masq
service dhcp3-server restart
  1. setting nat
  2. install dhcpd-server
  3. install dnsmasq to handle option domain-name-servers; or you could set it to and skip install dns-masq
share|improve this answer
dnsmasq also does DHCP. If you're going to install dnsmasq, I wouldn't don't bother with dhcp3-server. –  Steven Monday Apr 12 '11 at 15:07
ive got some problems with vpn-s and dhcpd dnsmasq. and i dont know why that worked for me. now im having my own bind9 for that :D –  MealstroM Apr 13 '11 at 6:12
The iptables part of this answer works fine. There is, I think, at least one bug in the dhcpd stuff, namely that the interface in /etc/default/dhcp3-server should be the internal interface (where systems send their DHCP requests", not the external one. –  Paul Hoffman Apr 24 '11 at 17:59
@Paul Hoffman you are right. –  MealstroM Apr 25 '11 at 8:58
And a late comment because this came and bit me on the butt late in the game: do not forget to "echo 1 > /proc/sys/net/ipv4/ip_forward" every time you boot this box. –  Paul Hoffman May 17 '11 at 2:33

I in fact do exactly this -- for a couple of years an old HP mini-tower served as my home network's router, until it fried in a blackout (hardware's not worth troubleshooting the fault); I'll be building a brand new system for this very same purpose shortly, so I'll be sure to write up a how-to as I do that.

In the meantime, however, I'll point you to the same resource I use: Shorewall, and specifically the how-to for a two-interface firewall. The site's documentation also has similar articles for one- and three-interface setups, so pick the one that best suits your needs. I find using Shorewall to be a lot easier and a lot more intuitive than directly manipulating iptables (Shorewall is really just a configuration layer that sits atop iptables, so the end result is very much the same, except that it handles a lot of basic, low-level stuff you wouldn't even think of, like smurfs (packets with a broadcast address as the source) and martians (packets with impossible source addresses)).

share|improve this answer

Your Answer


