Moxa TC-6110-T-LX [43/117] Saving the firewall

TC-6110 Linux User's Manual Managing Communications

3-25

Saving the Firewall

You must your firewall so that it will reload on the next reboot; otherwise, the rules witll be flushed and the

firewall permanently deleted. After configuring iptables, the following command will save the ruleset to

/etc/sysconfig/iptables:

moxa@MOXA:~# /sbin/service iptables save

NAT (Network Address Translation)

The NAT (Network Address Translation) protocol translates IP addresses used on a local network into IP

addresses used on a connecting network. One network is designated the inside network and the other is the

outside network. Typically, the TC-6110-LX connects several devices on a network and maps local inside

network addresses to one or more global outside IP addresses, and translates the global IP address used on by

packets coming in from the WAN back into local IP addresses.

IP Tables NAT Policies

IP tables policies for the NAT table should all be ACCEPT (see the section above, Netfilter Policy Examples,

for more information):

# iptables -t nat -P PREROUTING ACCEPT

# iptables -t nat -P POSTROUTING ACCEPT

# iptables -t nat -P OUTPUT ACCEPT

Source NAT (SNAT) and Destination NAT (DNAT)

Source NAT (SNAT) is when the source address is altered on the first packet of an outbound connection. That

is, it changes the originating address (which is usually a LAN address that looks like 192.168.xxx.xxx) for

outbound packets so that they show the IP address with which the connection to the open internet is

associated.

Destination NAT (DNAT) is when the destination address is altered on the first packet of an outbound

connection. That is, it changes the originating address (which is usually a LAN address that looks like

192.168.xxx.xxx) for outbound packets so that they show the IP address with which the connection to the

open internet is associated.

ATTENTION

Click on the following link for more information about NAT

http://www.netfilter.org/documentation/HOWTO/NAT-HOWTO.html

Enabling NAT Masquerading

NAT masquerading allows you to create a subnet of devices mapped to a single IP address. When used with

port forwarding and static IP addressing, it can allow you to expand a single public IP address to a very large

LAN.

To enable NAT in your device, first load the NAT module:

moxa@MOXA:~# modprobe ipt_MASQUERADE