Building an Ubuntu Router Part 3 - Firewall/NAT

Firewall

Add rules to allow traffic on your loopback interface:

sudo iptables -A INPUT -i lo -j ACCEPT
sudo iptables -A OUTPUT -o lo -j ACCEPT

And lets also allow anything on the LAN:

sudo iptables -A INPUT -i enp0s8 -j ACCEPT

To accept traffic being forwarded from the LAN to the WAN:

sudo iptables -A FORWARD -i enp0s8 -o enp0s3 -j ACCEPT
sudo iptables -A INPUT -i enp0s3 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A FORWARD -i enp0s3 -o enp0s8 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

We should accept traffic from the WAN going to the LAN if, and only if, the LAN initiated the connection:

Enable Ip Forwarding

Edit the file sysctl.conf to activate it permanently.

sudo cp /etc/sysctl.conf{,.bak}
sudo nano /etc/sysctl.conf

Change the value of net.ipv4.ip_forward from 0 to 1

net.ipv4.ip_forward=1

Activate the changes with the following command.

sudo sysctl -p

Through iptables we change the destination address of the packets to the interface enp0s3 which has an internet connection.

sudo iptables -t nat -A POSTROUTING -o enp0s3 -j MASQUERADE

The configuration can be viewed with the following command.

sudo iptables -L -v

Saving Iptables Firewall Rules Permanently

Unable to locate package iptables-persistent directly, it is necessary to change source.list and update to be able to install it.

sudo cp /etc/apt/sources.list{,.bak}
sudo nano /etc/apt/sources.list

Add at the end of each source universe.

deb http://archive.ubuntu.com/ubuntu bionic main universe
deb http://archive.ubuntu.com/ubuntu bionic-security main universe
deb http://archive.ubuntu.com/ubuntu bionic-updates main universe

Update and install iptables-persistent

sudo apt-get update
sudo apt install iptables-persistent -y

Each time a rule change is made, save the changes with the following command.

sudo dpkg-reconfigure iptables-persistent

(You will need to answer yes to the questions about whether to save the rules.)

After that, the next time iptables-persistent is started/restarted, the iptables rulesets you expect will be loaded.