CentOS 7 as NAT Gateway for Private Network

Original site: http://blog.redbranch.net/2015/07/30/centos-7-as-nat-gateway-for-private-network/

The scenario is a small private network connected via a switch and using 192.168.0. addresses. One of the machines (let’s call it RTR001) on the network has two network interface cards. One with an address on the 192.168.0. network and another providing wider network (& internet) access on a 123.111.123. network. This machine (RTR001) will take traffic from the private network 192.168.0. and route it out via its other interface to the internet etc.

So the router machine (RTR001) has the following interfaces and IP addresses:

• eth0 123.111.0.1


• eth1 192.168.0.1

Configure the kernel to forward IP packets:

To avoid rebooting implement the same change dynamically:

On CentOS 7, after configuring both network interfaces, we need to use firewalld:

After making changes reload with:

Check the settings to ensure your interfaces are listed in the correct zone:

If you have made a mistake you can remove the interface from the zone with:

Configure masquerading on the externally facing device (eth0):

Now the NAT rule (see comments – this may not be required):

I was running DNS, DHCP, pxe and several other services from my RTR001 machine to service the internal computers so I opened those ports with:

Reload the firewall rules and test pings from the internal machines: