CloudLabBox
Try the free demo

Linux for network engineers lab 5 of 14

Firewall and NAT with iptables

You turn a Linux box into the depot firewall: masquerade, a stateful default-deny policy, protection for the box itself, a published web server, logging, and rules that survive a reboot.

Run this lab

It needs Lite: its 5 nodes are set to 5 vCPU and 2,560 MB in total. That fits the free demo too.

In your workspace: Shared, then Linux for network engineers guided labs, then 05 - Firewall and NAT with iptables

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 80 minutes
Nodes need
5 vCPU, 2,560 MB
Smallest plan
Lite

The scenario

Kestrel's Doncaster depot has one public address, a LAN, a small DMZ with the web app, and no firewall budget. FW is a Linux box with three ports. By the end of today it has to share the public address, allow only what the depot needs, keep the Internet away from its own admin page, and publish the web app.

DeviceInterfaceAddressRole
H1eth010.5.10.10/24LAN PC, gateway .1
SRVeth010.5.20.10/24DMZ server, gateway .1, app on TCP 8080
FWeth010.5.10.1/24LAN
FWeth110.5.20.1/24DMZ
FWeth2203.0.113.2/29public side; admin page on TCP 8000
R1Gi0/0, Gi0/1203.0.113.1/29, 198.51.100.1/24the ISP (no route to Kestrel's private addresses)
NET1eth0198.51.100.10/24a host on the Internet, web on 80 and 8888
DeviceRunsHow to log in
H1, SRV, NET1Alpine Linux 3.20root, no password.
R1Cisco IOSv 15.9The console opens at >; enable has no password.
FWAlpine Linux 3.16 with iptables and iproute2Opens on a menu: press 5, then Enter, for a root shell.

What you’ll practise

  • Follow a packet through the netfilter tables and chains
  • Share a public address with MASQUERADE
  • Write a stateful default-deny FORWARD policy
  • Protect the firewall with INPUT rules
  • Publish a server with DNAT and the matching filter rule
  • Log drops, save rules and read the matching nft syntax

The tasks

  1. Start the Linux nodes
  2. Read the tables
  3. Share one public address
  4. Default deny, stateful
  5. Publish the web app
  6. Log what you drop

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Firewall and NAT with iptables5 nodes, 4 links. Every link is listed as text below the diagram.H1SRVNET1R1FWGi0/1eth0eth2Gi0/0eth0eth0eth1eth0
5 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • FW eth0 to H1 eth0
  • FW eth1 to SRV eth0
  • FW eth2 to R1 Gi0/0
  • R1 Gi0/1 to NET1 eth0
Nodes in Firewall and NAT with iptables, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
H1Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
SRVAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
NET1Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
R1Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
FWAlpine WAN emulatorclbalpinewanem-alpine-3-16-2-wanem1 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Linux for network engineers guided labs.

  3. Open 05 - Firewall and NAT with iptables and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Linux for network engineers labs

All Linux for network engineers labs

Related labs in other courses

CloudLabBox is independent of Cisco, CompTIA, the Linux Foundation and the Linux Professional Institute. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.