| View previous topic :: View next topic |
| Author |
Message |
GentooBox
Veteran
Joined: 22 Jun 2003
Posts: 1168
Location: Denmark
|
 Posted: Thu Aug 21, 2003 8:37 pm Post subject: Masquerade and/or Forward ? |
 |
|
Hi.
I have a little Q.
Im new to iptables and im in the mittle of a script, but im stuck.
i have this network:
| Code: |
network Firewall network
192.168.1.1 --- [eth0] 192.168.1.254 [eth1] --- 192.168.0.1
|
and i want the firewall (192.168.1.254) to share the internet out to 192.168.0.1.
Should i use forward ? or is that only for port forwarding.
or
Should i use Masquerade ? and what is that ?
_________________
Encrypt, lock up everything and duct tape the rest |
|
| Back to top |
|
 |
bmichaelsen
Veteran
Joined: 17 Nov 2002
Posts: 1277
Location: Hamburg, Germany
|
| Posted: Thu Aug 21, 2003 9:21 pm Post subject: |
|
|
From http://www.mandrakesecure.net/en/docs/HOWTO/NAT-HOWTO/NAT-HOWTO.linuxdoc-4.html
| Quote: |
4.1 I just want masquerading! Help!
This is what most people want. If you have a dynamically allocated IP PPP dialup (if you don't know, you do have one), you simply want to tell your box that all packets coming from your internal network should be made to look like they are coming from the PPP dialup box.
# Load the NAT module (this pulls in all the others).
modprobe iptable_nat
# In the NAT table (-t nat), Append a rule (-A) after routing
# (POSTROUTING) for all packets going out ppp0 (-o ppp0) which says to
# MASQUERADE the connection (-j MASQUERADE).
iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
# Turn on IP forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward
Note that you are not doing any packet filtering here: for that, see the Packet Filtering HOWTO: `Mixing NAT and Packet Filtering'.
|
EDIT: (Added)
| Quote: | | Should I use masquerading ? |
If you use the above, you do. See the howto for more on how it works.
The howto was on also www.netfilter.org/documentation - but the site seems to be down (at least from here, MSBlaster still rioting ??) |
|
| Back to top |
|
|
GentooBox
Veteran
Joined: 22 Jun 2003
Posts: 1168
Location: Denmark
|
| Posted: Fri Aug 22, 2003 6:59 am Post subject: |
|
|
Well...
that means that i should use Masquerading if i have a dynamic ip address and i should use forward if i have static ip addresses ?`
_________________
Encrypt, lock up everything and duct tape the rest |
|
| Back to top |
|
|
vert
Apprentice
Joined: 07 May 2002
Posts: 214
Location: Delft, The Netherlands
|
| Posted: Fri Aug 22, 2003 9:06 am Post subject: |
|
|
Yeah, but if you bring up your firewall everytime your ip changes (usually, with pppoe you specify to (re)start the firewall each time your ppp link goes up) you can also do a simple grab for your ip address and use it as if it was static. Then you can use forward. This is how I used to do it. I believe forward has slightly less overhead than masquerading. Maybe it has other advantages as well, I can't remember.
I used this piece of code to grab my ip.
| Code: |
INET_IFACE=$(/sbin/ifconfig|grep 'Point-to-Point Protocol' | cut -s -d ' ' -f1)
INET_IP=$(/sbin/ifconfig|grep 'P-t-P'|cut -s -d ' ' -f12|grep addr|cut -d ':' -f2)
|
PS: netfilter.org has been down for the last few days |
|
| Back to top |
|
|
GentooBox
Veteran
Joined: 22 Jun 2003
Posts: 1168
Location: Denmark
|
| Posted: Tue Aug 26, 2003 9:50 am Post subject: |
|
|
hmm... im still confused. 
eksample:
1) I have a network with a internet connection (with static ip)
2) A firewall (with eth0 to the internet and eth1 to the trusted network(eth1 is connected to the same switch as the terminal server))
3) And i got a terminal server (only eth0 connected to a switch)
they all use static ip addresses.
I want to share my internet connection into the firewall and out to the terminal server.
NOW.... badadadaaam... the scary part: 
Should i use FORWARD ? or is FORWARD only used to forward a single port or the whole connection.
Should i use MASQURADE ? or is it only for dynamic ip addresses ? (witch i dont have in my eksample)
Should i use NAT table with POSTROUTE and PREROUTE ? and what is that ?
Hope that you will help my in my quest of iptables 
_________________
Encrypt, lock up everything and duct tape the rest |
|
| Back to top |
|
|
GentooBox
Veteran
Joined: 22 Jun 2003
Posts: 1168
Location: Denmark
|
| Posted: Tue Aug 26, 2003 8:03 pm Post subject: |
|
|
*bump* please 
_________________
Encrypt, lock up everything and duct tape the rest |
|
| Back to top |
|
|
bmichaelsen
Veteran
Joined: 17 Nov 2002
Posts: 1277
Location: Hamburg, Germany
|
| Posted: Tue Aug 26, 2003 8:55 pm Post subject: |
|
|
Activating IP_Foward is allowing packets recieved on one interface to be reemitted on another, I think (so you need it anyways in your setup).
Ok, I will give it a try to explain MASQUERADEing:
Example: One of your clients wants to see google.com
It sends a packet with google's ip as destination to the firewall-box (because it is the gateway)
The fw-box sends packet out to the internet
This would not work with an unmodified packet, because its Source-IP field contains the ip of the local cllient (192.168.1.XXX) - and googles answer to this ip would never return to the fw-box.
So MASQUERADEing/NAT rewrites the source ip to the fw-boxes ip on the internet interface and the source port to some free high port and sends the packet to the internet. google now returns its answer to this port on the internet-interface of the fw-box. Then MASQ/NAT on the fw-box remembers the port was used for the request by client xxx and rewrites the destination ip to the ip of the client.
POSTROUTING means the rewrite of ip-adress/port happens after deciding over which interface the packet will be sent. |
|
| Back to top |
|
|
bmichaelsen
Veteran
Joined: 17 Nov 2002
Posts: 1277
Location: Hamburg, Germany
|
| Posted: Tue Aug 26, 2003 8:59 pm Post subject: |
|
|
so nat/masq *pretends* all packet going to the internet coming from itself.
and it pretends all packets returned to clients to be coming directly from the internet |
|
| Back to top |
|
|
GentooBox
Veteran
Joined: 22 Jun 2003
Posts: 1168
Location: Denmark
|
| Posted: Tue Aug 26, 2003 9:44 pm Post subject: |
|
|
thanks..
So how should my setup look like if i dont use masqueradeing ?
use this eksample: (use your own, if you got a better one )
1) I have a network with a internet connection (with static ip)
2) A firewall (with eth0 to the internet and eth1 to the trusted network(eth1 is connected to the same switch as the terminal server))
3) And i got a terminal server (only eth0 connected to a switch)
they all use static ip addresses.
I want to share my internet connection into the firewall and out to the terminal server.
_________________
Encrypt, lock up everything and duct tape the rest |
|
| Back to top |
|
|
bmichaelsen
Veteran
Joined: 17 Nov 2002
Posts: 1277
Location: Hamburg, Germany
|
| Posted: Tue Aug 26, 2003 11:17 pm Post subject: |
|
|
| Quote: | | So how should my setup look like if i dont use masqueradeing ? |
Actually, I think, you should use SNAT according to the NAT HOWTO ...
Otherwise (without SNAT or MASQ) you would not be able to use the internet connection by more that one client at all. And you would have to forward ports directly from the internet which just makes you vulnerable.
Your setup:
| Code: |
Internet Firewall/Router LAN
213.162.73.83 --- [eth0] 213.162.73.90
(your ISPs IP) 192.168.1.254 [eth1] --- 192.168.1.0
|
On 192.168.1.254 (fw)
| Code: |
iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to 213.162.73.90
echo 1 > /proc/sys/net/ipv4/ip_forward
|
On 192.168.1.0 (all clients in LAN) set gateway to 192.168.1.254.
You are using SNAT then - masqueradeing would just be a special form of SNAT because you dont specify a fixed ip-address. That makes it useable for dialup. But because you know your IP on eth0 (because you have a fixed one: 213.162.73.90) you can use simple SNAT because it has less overhead (I think that is the reason the HOWTO says in Chapter 6.1:
| Quote: | | it should only be used for dynamically-assigned IP addresses, such as standard dialups (for static IP addresses, use SNAT above). |
You can even specify a port range iptables should use for SNAT. That could be useful if you want to make any services available (anything that must be able to initiate a connection FROM the internet - examples: www-Server, ftp-Server, gnutella ...), because you might want to reserve some ports for these services. |
|
| Back to top |
|
|
|
Networking & Security
