FreiFunkFirmware - Howto disable NAT

This posting describes how to disable NAT within the Freifunk Firmware. Freifunk Firmware is an OpenWRT based Linux Distribution available at http://www.olsrexperiment.de/sven-ola/ipkg/ More Information about the Freifunk Firmware can be found at the Freifunk Wiki


Login
Use ssh to login to your Router running Freifunk Firmware. I will use 104.7.2.1 as IP for Router in the examples below.

ssh root@104.7.2.1
root's password: ***********
root@gw1-wrt54gs:~#


See what NAT Rules are active
In order to see the active NAT rules use iptables.

root@gw1-wrt54gs:~# iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target prot opt source destination

Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- 104.7.2.16/28 anywhere
MASQUERADE all -- 104.7.2.32/27 anywhere
MASQUERADE all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
root@gw1-wrt54gs:~#


In the example above we have 3 NAT Rules being active. Active NAT Rules are the lines start with "MASQUERADE". In order to delete them you have to use iptables again.


iptables -t nat -D POSTROUTING <rulenum>;


The rules are numbered starting with 1 at the first rule. In the example above the line MASQUERADE all -- 104.7.2.16/28 anywhere
ist rule number "1". In order to delete the three rules above we have to enter the following three commands.


root@gw1-wrt54gs:~# iptables -t nat -D POSTROUTING 3;
root@gw1-wrt54gs:~# iptables -t nat -D POSTROUTING 2;
root@gw1-wrt54gs:~# iptables -t nat -D POSTROUTING 1;


Do it automatically
In order to do automatically what we just did manual you have to edit the file /etc/local.fw. This file holds the local firewall options. To delete the three nat rules every time the firewall starts add the commands from above in the start section of /etc/local.fw.

Afterwards your /etc/local.fw should look like the following:

# Place your firewall addons here

case $1 in
        start)
        iptables -t nat -D POSTROUTING 3;
        iptables -t nat -D POSTROUTING 2;
        iptables -t nat -D POSTROUTING 1;
        ;;
        stop)
        ;;
esac

Restart the firewall
In order to commit changes made we have to stop and start the firewall.

root@gw1-wrt54gs:~# /etc/init.d/S45firewall stop;
root@gw1-wrt54gs:~# /etc/init.d/S45firewall start;