Introduction
In this blog I will show you how to configure a RHEL 6 server as router for LAN (eth1) and WAN (eth0).
Enable IP forwarding
First we need to enable IP forwarding.
$ sysctl -w "net.ipv4.ip_forward=1"
net.ipv4.ip_forward = 1
And to verify.
$ sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1
To make it permanent, you need to edit /etc/sysctl.conf.
$ grep "^net.ipv4.ip_forward" /etc/sysctl.conf
net.ipv4.ip_forward = 1
Configure Router Server Network
Before we begin, we disable NetworkManager.
$ service NetworkManager stop
$ chkconfig NetworkManager off
Then we manually edit our network configuration files.
We begin with our WAN (eth0) card.
$ cat /etc/sysconfig/network-scripts/ifcfg-eth0
DEVICE=eth0
TYPE=Ethernet
HWADDR=64:70:02:11:d9:83
NM_CONTROLLED=no
ONBOOT=yes
BOOTPROTO=none
IPADDR=192.168.1.100
NETMASK=255.255.255.0
GATEWAY=192.168.1.1
DNS1=192.168.1.1
And continue with our LAN (eth1) card.
$ cat /etc/sysconfig/network-scripts/ifcfg-eth1
DEVICE=eth1
TYPE=Ethernet
HWADDR=64:70:02:13:CB:95
NM_CONTROLLED=no
ONBOOT=yes
BOOTPROTO=none
IPADDR=192.168.2.100
NETMASK=255.255.255.0
GATEWAY=192.168.1.1
DNS1=192.168.1.1
The above HWADDR is different for your environment. To get yours use ifconfig.
$ ifconfig
eth0 Link encap:Ethernet HWaddr 64:70:02:11:D9:83
...
eth1 Link encap:Ethernet HWaddr 64:70:02:13:CB:95
...
Finally restart network service and check new ip addresses are set, via ip or ifconfig command.
$ service network restart
$ ip addr show
...
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
...
inet 192.168.1.100/24 brd 192.168.1.255 scope global eth0
...
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
...
inet 192.168.2.100/24 brd 192.168.2.255 scope global eth1
...
iptables
Now we are ready to configure iptables. First flush existing rules.
$ iptables -t filter -F
$ iptables -t nat -F
$ iptables -t mangle -F
Then add the MASQUERADE roule to the WAN (eth0) card
$ iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
Finally save iptables configuration.
$ service iptables save
Test
I have connected a separate machine on LAN and configure it manually with static IP.
$IP: 192.168.2.3
NETMASK: 255.255.255.0
GATEWAY: 192.168.2.100
DNS1: 192.168.2.100
Now we can ping 192.168.2.100 (gateway), 192.168.1.100 (rhel 6 router), 192.168.1.1 (WAN GATEWAY) and finally www.google.com.
