Step-by-Step Guide to Build a Secure Linux Network with iptables and DHCP

Network Topology Diagram and Description

Explanation

The server uses a static external IP (eth0 = 200.0.0.2) and connects eth1 to an internal switch with subnet 192.168.10.0/24.

All internal machines obtain IPs via DHCP; 192.168.10.254 is an FTP server that must be reachable from outside.

The server provides only DHCP and SSH services to the internal network.

Internal machines use the ISP's DNS servers.

Configuration Steps

(System IP configuration omitted)

1. Disable the built‑in firewall

Stop the firewalld service: systemctl stop firewalld Prevent it from starting on boot: systemctl disable firewalld 2. Install iptables and DHCP server

yum -y install iptables-services

yum -y install dhcp

3. Initialize iptables

iptables -F

iptables -t nat -F

iptables -P INPUT DROP

iptables -P OUTPUT ACCEPT

iptables -P FORWARD DROP

4. Enable IP forwarding in the kernel

echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf

sysctl -p

5. Configure the DHCP server

File:

/etc/dhcp/dhcpd.conf

# Provide DHCP for 192.168.10.0/24
subnet 192.168.10.0 netmask 255.255.255.0 {
  range 192.168.10.2 192.168.10.253;   # address pool
  option broadcast-address 192.168.10.255;
  option routers 192.168.10.1;
  option domain-name-servers 202.96.134.33, 202.96.128.22;
  option netbios-name-servers 192.168.10.1;
  option domain-name "lan";
  default-lease-time 86400;
  max-lease-time 86400;
}

# Static binding for FTP server
host ftp_server {
  hardware ethernet 12:34:56:11:11:11;
  fixed-address 192.168.10.254;
}

6. Allow inbound connections in iptables

iptables -A INPUT -i lo -j ACCEPT

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A INPUT -i eth1 -p udp --dport 67:68 -j ACCEPT

iptables -A INPUT -i eth1 -p tcp --dport 22 -j ACCEPT

7. Configure NAT and port forwarding (key step)

iptables -A FORWARD -s 192.168.10.0/24 -j ACCEPT

iptables -t nat -A POSTROUTING -s 192.168.10.0/24 -j SNAT --to 200.0.0.2

iptables -t nat -A PREROUTING -d 200.0.0.2 -p tcp --dport 21 -j DNAT --to 192.168.10.254

iptables -A FORWARD -d 192.168.10.254 -p tcp --dport 21 -j ACCEPT

8. Save iptables rules iptables-save > /etc/sysconfig/iptables 9. Start and enable services

systemctl start iptables

systemctl enable iptables

systemctl start dhcpd

systemctl enable dhcpd

Configuration complete.