Build a Secure LAN with iptables NAT and DHCP on CentOS

Network Topology Diagram

Explanation

The server uses a static public IP (eth0 = 200.0.0.2) and connects to an internal switch via eth1 (192.168.10.0/24).

All internal machines obtain IPs via DHCP; 192.168.10.254 is reserved for an FTP server.

The server provides only DHCP and SSH services to the internal network.

Internal machines use the ISP's DNS servers.

Configuration Steps

(System IP configuration omitted)

1. Disable the built‑in firewall

systemctl stop firewalld
systemctl disable firewalld

2. Install iptables and DHCP server

yum -y install iptables-services
yum -y install dhcp

3. Initialize iptables

iptables -F
iptables -t nat -F
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP

4. Enable IP forwarding

echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
sysctl -p

5. Configure the DHCP server ( /etc/dhcp/dhcpd.conf )

# Provide DHCP for 192.168.10.0/24
subnet 192.168.10.0 netmask 255.255.255.0 {
  range 192.168.10.2 192.168.10.253;    # address pool
  option broadcast-address 192.168.10.255;    # broadcast address
  option routers 192.168.10.1;    # default gateway
  option domain-name-servers 202.96.134.33, 202.96.128.22;    # ISP DNS
  option netbios-name-servers 192.168.10.1;    # WINS server
  option domain-name "lan";    # search domain
  default-lease-time 86400;    # seconds
  max-lease-time 86400;    # seconds
}
# Static binding for FTP server
host ftp_server {
  hardware ethernet 12:34:56:11:11:11;    # MAC address
  fixed-address 192.168.10.254;    # bound IP
}

6. Allow inbound connections in iptables

iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i eth1 -p udp --dport 67:68 -j ACCEPT
iptables -A INPUT -i eth1 -p tcp --dport 22 -j ACCEPT

7. NAT and port forwarding (key step)

# Allow outbound traffic from the LAN
iptables -A FORWARD -s 192.168.10.0/24 -j ACCEPT
# Source NAT – translate internal IPs to the public IP
iptables -t nat -A POSTROUTING -s 192.168.10.0/24 -j SNAT --to 200.0.0.2
# Port mapping for FTP service
iptables -t nat -A PREROUTING -d 200.0.0.2 -p tcp --dport 21 -j DNAT --to 192.168.10.254
iptables -A FORWARD -d 192.168.10.254 -p tcp --dport 21 -j ACCEPT

8. Save iptables configuration

iptables-save > /etc/sysconfig/iptables

9. Start services and enable them at boot

systemctl start iptables
systemctl enable iptables
systemctl start dhcpd
systemctl enable dhcpd

Configuration complete.