NAT systems have at least two network interfaces configured.
The first network interface will be setup as the Internet facing connection. For this document I'm going to just use interfaces " "eth0", "eth1", "eth2", "eth2.526" (IEEE 802.1Q tagged vlan, id="526" on eth2 Nic) , and an IPv4 Internet address 198.51.100.63 in "TEST-NET-2" vlan 198.51.100.0/24 (in accordance with RFC 5737.) You will need to modify the vlan information to the values of the Internet vlan that services your area!
We'll configure four other network interfaces, one for each Intranet (private vlan) that we want to provide NAT service for. For this documentation we'll use three 24bit vlans in the 172.16.0.0/12 block of private IPv4 address space assigning "172.X.Y.254" as the NAT route point 1 .
Arrange with the CSCF Technical Manager, Infrastructure for the resources to run the NAT service you want to setup, then follow one of the recipes at "https://cs.uwaterloo.ca/cscf/internal//infrastructure/setups/os/ubuntu/" to provision a minimal Ubuntu server host
Next configure the servers network configuration so the appropriate network interfaces are created at startup, being sure to modify the IP values to be appropriate for your environment.
Edit "/etc/network/interfaces":
auto lo
iface lo inet loopback
auto eth0
iface eth0 inet static
address 198.51.100.63
netmask 255.255.255.0
gateway 198.51.100.1
network 198.51.100.0
broadcast 198.51.100.255
auto eth1
iface eth1 inet static
address 172.19.152.254
netmask 255.255.255.0
auto eth2
iface eth2 inet static
address 172.19.154.254
netmask 255.255.255.0
auto eth2.526
iface eth2.526 inet static
address 172.19.155.254
netmask 255.255.255.0
We enable IPv4 forwarding by creating "/etc/sysctl.d/98-ip_forward.conf"
# # Kernel sysctl configuration # net.ipv4.ip_forward = 1
You can run the following command to make this change effective without a reboot.
sudo sysctl -w net.ipv4.ip_forward=1
We use iptables to perform the masquerading of the non-eth0 traffic by modifying "/etc/rc.local" (Make sure the following two lines appear before the "exit 0" line.)
/sbin/iptables -P FORWARD ACCEPT /sbin/iptables --table nat -A POSTROUTING -o eth0 -j MASQUERADE
You can run the following commands to make this change effective without a reboot.
sudo iptables -P FORWARD ACCEPT sudo iptables –-table nat -A POSTROUTING -o eth0 -j MASQUERADE
I choose to use an IP address one less than the broadcast IP as the NAT route point to leave IP space near the first VLAN ip address for VRRP addresses. There is also a bit of nostalgia involved: "Who remembers when the CISCO standard was to use the IP before the broadcast IP as the default route point?" ↩