ubuntu: enable ip forwarding using ufw

ufw is ubuntu's firewall configuration tool

to enable ufw
# ufw enable

to allow a port
# ufw allow <port>
ex. # ufw allow 22

edit /etc/default/ufw to accept forwarding requests
default_forward_policy = "accept"

edit /etc/ufw/sysctl.conf to allow forwarding
net.ipv4.ip_forward=1

edit /etc/ufw/before.rules, add the ff. after the first comment

# nat Table rules
*nat
:PREROUTING ACCEPT [0:0]

:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]

# Forward traffic from eth1 through eth0.
-A POSTROUTING -s 223.223.223.0/24 -j SNAT --to 192.168.0.145
#-A POSTROUTING -s 223.223.223.1 -o eth0 -j MASQUERADE
-A POSTROUTING -s 223.223.223.1 -j SNAT --to 192.168.0.145
-A POSTROUTING -s 223.223.223.2 -j SNAT --to 192.168.0.145

# don't delete the 'COMMIT' line or these table rules won't be processed
COMMIT


reload ufw by disabling and enabling the firewall

# ufw disable
# ufw enable


linux: enable ipv4 forwarding

to enable ipv4 forwarding on a linux box, set ip_forward file to 1
# echo "1" > /proc/sys/net/ipv4/ip_forward
this enables forwarding till you reboot your box

to make ip forwarding available upon boot, you can set forwarding in /etc/sysconfig/network by adding
FORWARD_IPV4="TRUE"
i have a note that this doesn't work on CentOS, though.

another way is to create a start-up script to set a value in the ip_forward file
# vi /etc/init.d/ip_forward

then add the following lines:
#!/bin/bash
# ip_forward
#
# chkconfig: 235 90 25
# description:  enable ip_forward

PATH=/usr/bin:/sbin:/bin:/usr/sbin
export PATH

# Source function library.
. /etc/rc.d/init.d/functions
# Source networking configuration.
. /etc/sysconfig/network

start() {
        echo "1" > /proc/sys/net/ipv4/ip_forward
}

stop() {
        echo "0" > /proc/sys/net/ipv4/ip_forward
}

restart() {
    stop
    start
}

status() {
        cat /proc/sys/net/ipv4/ip_forward
}

case "$1" in
start)
    start
    ;;

stop)
    stop
    ;;

restart)
    restart
    ;;

status)
    status
    ;;
*)
    echo $"Usage: $0 {start|stop|status}"
    exit 1
esac

exit $?


after creating the start-up file, add it in chkconfig as a service
# chkconfig --add ip_forward

ps. you can also just add this to your network start-up script
echo "1" > /proc/sys/net/ipv4/ip_forward

happy forwarding!!

ps. ps. one more way to do this in CentOS (tried it in 6.3) is by editing your /etc/sysctl.conf
# Controls IP packet forwarding
net.ipv4.ip_forward = 1

iptables: port forwarding, multiple ports, port range

in your /etc/sysconfig/iptables...

to forward from receiving ip to destination ip on the same port:

# nat to destination - forward all requests received by receiving ip on receiving port to destination ip
-A PREROUTING -d <receiving ip> -p tcp --dport <receiving port> -j DNAT --to <destination ip>


# nat from destination - mask incoming from destination ip on receiving port as from receiving ip
-A PREROUTING -d <destination ip> -p tcp --dport <receiving port> -j SNAT --to <receiving ip>

to forward from receiving ip's specific port to destination ip's different port:

# nat to destination - forward all requests received by receiving ip on receiving port to destination ip on different port
-A PREROUTING -d <receiving ip> -p tcp --dport <receiving port> -j DNAT to <destination ip>:<destination port>


# nat from destination - mask incoming from destination ip's destination port as from receiving ip's receiving port
-A POSTROUTING -d <destination ip> -p tcp --dport <destination port> -j SNAT --to <receiving ip>:<receiving port>

see sample below:

to forward to a port range:
-A PREROUTING -d <receiving ip> -p tcp --dport <start of port range>:<end of port range> -j DNAT --to <destination ip> --sport <start of port range>:<end of port range>
-A POSTROUTING -d <destination ip> -p tcp --dport <start of port range>:<end of port range> -j SNAT --to  <receiving ip> --sport <start of port range>:<end of port range>


be sure to accept connections to that port range:
-A INPUT -p tcp --dport <start of port range>:<end of port range> -j ACCEPT

linux: set ip forwarding

set ip_forward flag
# echo "1" > /proc/sys/net/ipv4/ip_forward

or set ip_forward in /etc/sysctl.conf
# vi /etc/sysctl.conf
set:
net.ipv4.ip_forward = 1