NDC & PKI

[Day 8] 7. IP Forwarding and NAT Configuration (LAB 4)

D
DITISS Admin
••5 min read

Network Configuration

| Machine | IP Address | Network Type | | -------------------- | ---------------------------------- | ---------------- | | Debian Machine 1 | 

192.168.40.10
| LAN | | Debian Machine 2 | 
192.168.40.101
, 
192.168.50.101
| Acts as Router | | Debian Machine 3 | 
192.168.50.10
| WAN |

Make sure you have given the correct gateways in both Debian 1 and Debian 3 as 

192.168.40.101
and 
192.168.50.101
respectively.

Steps

1. Initial State (Ping Failure)

  • Issue:
    • If you attempt to ping Deb1 (
      192.168.40.10
      ) from Deb3 (
      192.168.50.10
      ), the ping will fail.
    • Reason: IP packet forwarding is disabled by default on Deb2 (
      192.168.40.101
      and 
      192.168.50.101
      ), which is acting as a router.

2. Enable IP Forwarding on Debian 2

To allow traffic forwarding through Deb2, perform the following steps:

  • Check if packet forwarding is enabled:

    bash
    cat /proc/sys/net/ipv4/ip_forward
    • If the output is 
      0
      , forwarding is disabled.

  • Enable packet forwarding:

    bash
    sudo sh -c "echo 1 > /proc/sys/net/ipv4/ip_forward"
    • This command enables IP packet forwarding temporarily on Deb2.

3. Verify Ping (After Enabling Forwarding)

  • Now, try pinging Deb1 (
    192.168.40.10
    ) from Deb3 (
    192.168.50.10
    ).
  • The ping will work because forwarding is now enabled on Deb2.

4. Issue: IP Exposure in WAN Network

  • When IP packet forwarding is enabled, the private IP address of Deb1 (
    192.168.40.10
    ) gets exposed to the WAN network.
  • To resolve this and mask the private IP, we configure NATing (Network Address Translation) on Deb2.

5. View NAT Table in IPTables

  • To inspect the NAT table in iptables:

    bash
    sudo iptables -t nat -L

  • NAT Table Chains:

| Chain | Description | | --------------- | --------------------------------------------------- | | PREROUTING | Handles incoming packets (before routing decision). | | POSTROUTING | Handles outgoing packets (after routing decision). | | INPUT | For packets destined to the machine itself. | | OUTPUT | For packets generated by the machine. |

Here, we use 

POSTROUTING
when configuring 
static NAT
and 
PREROUTING
while using 
dynamic NAT
.

6. Configure NAT (MASQUERADE)

To configure NAT using the POSTROUTING chain:

bash
sudo iptables -t nat -A POSTROUTING -o ens36 -j MASQUERADE
  • Explanation: 
    • -t nat
      : Specifies the NAT table.
    • -A POSTROUTING
      : Appends the rule to the POSTROUTING chain.
    • -o ens36
      : Applies the rule to the ens36 interface (Deb2’s WAN-facing interface).
    • -j MASQUERADE
      : Masks the source IP address with the IP of the ens36 interface (
      192.168.50.101
      ).

7. Final State

  • Result:
    • Deb1 (
      192.168.40.10
      ) and Deb3 (
      192.168.50.10
      ) can now communicate through Deb2.
    • The private IP of Deb1 is masked, and WAN traffic sees the IP of Deb2’s ens36 interface (
      192.168.50.101
      ).

Here are the steps to check private IP exposure using 

tcpdump
on Deb3:

8. Steps to Check with 
tcpdump
on Deb3

  1. Install tcpdump (if not already installed):

    bash
    sudo apt-get install tcpdump

  2. Capture ICMP packets on Deb3’s interface (e.g., 

    ens36
    ):

    bash
    sudo tcpdump -i ens36 icmp

  3. Ping Deb1 (

    192.168.40.10
    ) from Deb3 (
    192.168.50.10
    ):

    bash
    ping 192.168.40.10

  4. Observe the Output:

    • Check if the source IP of ICMP packets shows Deb1’s private IP (
      192.168.40.10
      ).

If you still see the private IP, NATing is not configured correctly. Fix the NAT rule on Deb2.

Read Next

8/26/2026

[Day 8] 8. Extra

1. **Graphical Passwords**: These are passwords that use images or graphics instead of traditional alphanumeric characters. Users often select points...

8/26/2026

[Day 9] 1. PKI Lab in Short (XCA)

**Naming Conventions for Better Understanding** ### Root CA 1. **001-001-DB-rootca.xdb** – Root CA Database 2. **001-002-CRT-RootCA.crt** – Roo...