Andrew Mercer

Basic router

[Internal LAN] 
  [ subnet ]
        |
     [Switch]
        |
 [Internal NIC on Linux Router]
        [ ip_address ]
           |
   [Linux Router (acting as NAT/forwarder)]
           |
 [External NIC on Linux Router]
        [ ip_address ]
           |
       [Modem]
        [ ip_address ]

Netplan config

  • https://[ hostname ]/server/explanation/networking/configuring-networks
  • https://[ hostname ]/faq
network:
  version: 2
  ethernets:
    # enp1s0 is the internal network interface plugged into lan switch
    enp1s0:
      dhcp4: false
      dhcp6: false
      addresses:
        - [ subnet ]
      nameservers:
        addresses:
          - [ ip_address ]
    # enp4s0 is the external network interface plugged into modem switch
    enp4s0:
      dhcp4: false
      dhcp6: false
      addresses:
        - [ subnet ]
      routes:
        - to: default
          via: [ ip_address ]
      nameservers:
        addresses:
          - [ ip_address ]

Test the configuration

netplan generate

If it looks ok:

netplan apply

Enable packet forwarding

echo "net.ipv4.ip_forward=1" | sudo tee -a /etc/[ hostname ]
sysctl -w net.ipv4.ip_forward=1

iptables rules

NAT internal traffic out to modem

iptables -t nat -A POSTROUTING -o enp4s0 -j MASQUERADE

Accept forwarding from internal to external

iptables -A FORWARD -i enps10 -o enps40 -j ACCEPT

iptables -A FORWARD -i enp4s0 -o enp1s0 -m state --state RELATED,ESTABLISHED -j ACCEPT

Final configuration

iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Save iptables rules

sudo apt -y install iptables-persistent

sudo netfilter-persistent save

DHCP server

sudo apt -y install isc-dhcp-server && \
sudo systemctl enable isc-dhcp-server

# /etc/dhcp/[ hostname ]

authoritative; # uncomment this line

subnet [ ip_address ] netmask [ ip_address ] {
  range [ ip_address ] [ ip_address ];
  option routers [ ip_address ];
  option subnet-mask [ ip_address ];
  option domain-name-servers [ ip_address ],[ ip_address ];
}

# /etc/default/isc-dhcp-server

INTERFACESv4="enp1s0"

sudo systemctl restart isc-dhcp-server && \
sudo systemctl status isc-dhcp-server && \
journalctl -xe | grep dhcp