How does masquerade know the interface?

[tommy_fila]

Quick and simple question about iptables.

When specifying "-j MASDQUERADE", how does iptables know which interface it should obtain the IP from. In other words, lets say I have a dynamic internet IP, and use DHCP for my local network, how does iptables know which IP to use?

For example, I read the following in a how-to:

[DaveArb]

Change the source address is correct, to the IP of the outgoing interface. Iptables maintains internally information to allow it to return the response packets to the machine that originated the message.

Dave

[Anarcho]

I would really change the iptables command to this:

[tommy_fila]

[IHC]

this is in the default route

try ip route
it should list your device

[DaveArb]

[tommy_fila]

Ok, let me see if I understand this the right way.

Take the example I had with a computer acting as a firewall -- it's connected to the LAN and the internet.

So a packet comes in, gets DNAT'ed to one of the LAN computers. At the same time, I want it SNAT'ed using MASQUERADE. So MASQUERADE knows which IP on the firewall computer is connected to the LAN and which one to the internet?

You said that MASQUERADE assigns the IP of the default route. But how does it know which outgoing route and incoming packet will eventually take?

Now I have another question:

NAT also works without any specific DNAT or SNAT chains. Right? If I'm browsing the web from a computer on the LAN, it has to go through the firewall computer in order to get to the internet. Does iptables just remember where to packet came from on the LAN and use that address to DNAT incoming packets?

As you can see I'm a little confused. But thanks for all the help so far.
_________________
"What goes on in life, that goes for eternity."

[DaveArb]

It is a little confusing when you don't explicitly name the interface, that's the source of Anarcho's comment earlier. It still works, but it's confusing.

[tommy_fila]

Great explanation. It really helped clear up many of my questions.

One last confusion.

To the best of my knowledge, NAT doesn't work by itself. Computers inside the LAN have the firewall computer set as their gateway. But how does the firewall handle the requests? Is there a specific chain to forward all incoming packets from the LAN on to the internet?

Once again, thanks for helping me out. I hate being confused, and now it finally seems like I might understand the iptables enigma.
_________________
"What goes on in life, that goes for eternity."

[DaveArb]

[tommy_fila]

[DaveArb]

[tommy_fila]

So a Gentoo install can automatically function as a gateway? I thought the computer had to be configured a certain way in order for it to act as the gateway. From my Windows days, I remember using a program (e.g. Sygate) for my gateway computer. Gentoo knows when it's a gateway? Or do you need to enable some kernel options? (I remember reading about some kernel option about IP forwarding).

One more thing. Do I need to run a DNS server on my firewall computer? From what I've read, it seems like I need to install one.

Thanks again for sticking with me on this one.

And one more. I don't understand the following command. The command is supposed to block all telnet conncections:

[DaveArb]

[tommy_fila]

I really can't tell you how much you've helped me. Thanks again.

I'm still not 100% clear on the destination and source port deal.

You mentioned that the client side of telnet picks a random high number port. So, when an outside computer sends a telnet packet to my computer, it sends it to a random high port. So how would port 22, on the INPUT chain ever be touched? I don't understand
_________________
"What goes on in life, that goes for eternity."

[DaveArb]

[jamapii]

I think a few examples would help. Suppose you sit at a computer, directly connected to the internet, not using a router. You surf the web. You connect to port 80 of many webservers. Your external interface (the one connected to the internet) is ppp0.

These iptables rules will match:

[tommy_fila]

I'm going to be honest here. Even after the two lengthy explanations, I'm still not exactly sure how things work. To me it seems like the two posts actually say the opposite.

[DaveArb]

[tommy_fila]

Great. Finally I understand. Thank you again for helping me get through this.

On an unrelated note, would you recommend regulating outgoing traffic? I'm the only one who uses the computer, so I'm just wondering if there are security risks associated with allowing all outgoing traffic (e.g. I connect to a a malicious service which then responds and the response is not caught by the firewall because I allow established, related traffic to come in).
_________________
"What goes on in life, that goes for eternity."

[DaveArb]

I don't regulate outbound, except in very unusual circumstances. I'm responsible for a corporate network, and trying to outguess what's going to happen next is more work than I'm able to put in. And yet, everything ends up working fine. I see a lot of talk onforum about security measures that are way more than I'd ever be able to try. It's probably fun to do as an exercise, but my experience is, it isn't needed.

I connect to a a malicious service which then responds and the response is not caught by the firewall because I allow established, related traffic to come in

So, let's say you connect to port 80 of an evil web site. It then tries to connect back on port 31337. Unless your computer is already infected with Back Orifice, nothing happens because there's nothing to answer that connect request. Something has to listen on a port before the port can receive a connection. You're in more danger by evil.web trying to exploit security issues in your browser, something a packet filter isn't going to be able to help with.

Dave

[jamapii]

[tommy_fila]

[sschlueter]

[sschlueter]