david wong

Hey! I'm David, cofounder of zkSecurity and the author of the Real-World Cryptography book. I was previously a crypto architect at O(1) Labs (working on the Mina cryptocurrency), before that I was the security lead for Diem (formerly Libra) at Novi (Facebook), and a security consultant for the Cryptography Services of NCC Group. This is my blog about cryptography and security and other related topics that I find interesting.

Quick access to articles on this page:

more on the next page...

NAT with iptables : super fast tutorial posted April 2014

So I know how to use iptables, I know what a NAT is, but I don't want to learn how to exactly do it. Misery... I have to learn how to do it because I have an exam that will probably ask me how to do it in a few days. So I've been looking for a super simple tutorial, a 1 minute tutorial, on how to setup a NAT configuration with iptables in 1 minute. Couldn't really find it so here it is, if this is somewhat useful for someone, you're welcome.

First Step

For NAT to work, you have to allow forwarding on your server. Easy peasy:

$ echo 1 > /proc/sys/net/ipv4/ip_forward 

Also, before adding new iptables rules, be sure to check what rules you already have

$ iptables -L

you should allow some forwarding for it to work (if the policy is default to DROP). But this not a tutorial about iptables.

Static

I have a server with:

  • eth0 connected to the network

  • eth1 connected to internet

Let's modify the PREROUTING part. Traffic coming from internet on our public address (@pub) and trying to reach our machine:

$ iptables -t nat -A PREROUTING -d @pub -i eth0 -j DNAT --to-destination @priv

Let's modify the table nat, append a rule to the pretrouting section : something is trying to reach @pub ? Let's put it in our input interface eth0, jump to the Destination Nat protocol, which tells us to send the packet to @priv.

Now Let's modify the POSTROUTING part. Traffic coming from inside our network and trying to reach something, somewhere on internet:

$ iptables -t nat -A POSTROUTING -s @priv -o eth1 -j SNAT --to-source @pub

If the packet is coming from @priv, let's put it on our output interface eth1 and jump to the Source Nat Protocol that will modify the packet so it has the public address (@pub) as source.

Here! You did it. One private IP address mapped to one public IP address.

Dynamic

Same kind of configuration but now we have several private addresses and only one public address.

$ iptables -t nat -A POSTROUTING -s @priv/mask -j MASQUERADE

We can modify every packets coming from the subnetwork @priv to get masqueraded.

$ iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

Or we can just tell all the network to get masqueraded.

And this is it. No PREROUTING Needed.

Again, you're welcome ;)

4 comments

Exams posted April 2014

We've been a group of 4-5 students spending each nights at the Crémi these few last days, this building of three floors where each floor has around 10 rooms full of computers.

We work, we eat, we play, and we crash each other computers.

There are a bunch of games installed on every computers but we mostly play SauerBraten, a quake-like.

sauerbraten

My 15-year-old self would have spent most of his days here playing, if only he knew that his future campus would have such a sacred place :)

How do we crash each other computer? We just ssh into their machine and launch a fork bomb:

 :(){ :|:& };:

It operates by defining a function called ':', which calls itself twice, once in the foreground and once in the background.

comment on this story

Fast Fourier Transform posted April 2014

So, I've learned about Fourier every year in my bachelor of Mathematics and I'm learning about the efficient algorithm dealing with the Fourier Transform in my class of Algebra right now.

I found a really nice video explaining really quick what it is, concretely.

Here's wikipedia way of showing that fourier made by LucasVB, this crazy guy doing all those math gifs you've probably seen before :) more here

There's also a visualization in d3.js here: http://bl.ocks.org/jinroh/7524988

comment on this story

Just learn Vim posted March 2014

The editor I'm using the most is Sublime Text 3. It's just super easy to use and super useful when you combine it with the right plugins and snippets.

But I love switching editors. I've used Frontpage, Dreamweaver, PHP Designer, Netbeans, Notepad++... and others I can't remember. I've recently tried the beta of Light Table and Brackets (that is truly amazing!), and I am eagerly waiting for Atom the open source IDE of github.

I also love spending time with Emacs. It's hard to master but I dig the "you don't need a mouse" aspect. One thing I found really annoying though is that most software use Vim by default. Wanting to master emacs, I didn't want to spend time learning Vim as well and I started tweaking the settings so that software X would use emacs by default. And that works well until... But then you run into some complications, for example I'm still trying to figure out how to do a git diff with emacs, or you run into a machine without emacs, and then it's either nano, which is shitty, or something else that is installed on the machine... and vim is (almost?) always installed by default.

So I decided to just learn Vim. And it was actually easier than it sounded and I feel like I'm going to avoid a lot of headaches now. Sometimes it's better to learn and adapt rather than try to use our own tools.

And if you're like me, you'll actually have a lot of fun learning vim :)

comment on this story