Linux IP Masquerade HOWTO - The Linux Documentation Project

More documents

Recommendations

Info

== MODEMs: ppp and/or slip == WANs: T1, T3, ISDN, etc. == ISDN: for internal ISDN modems [ File systems ] == Non−MASQ options skipped == (Quota, ISO9660, Codepages, NTFS, etc ) * /proc filesystem support (CONFIG_PROC_FS) [Y/n/?] − YES: Required to dynamically configure the Linux forwarding and NATing systems [ Character devices ] == Non−MASQ options skipped == (multi−port serial, parallel, mice, Ftape, Sound, etc. ) == Don't forget to compile in serial port support for modem users == Don't forget to compile in mouse support So go ahead and "exit" and you should be prompted to save your config. NOTE: These are only components for IP Masquerade functionality. You may need to also select additional options to match your specific network and hardware setup. • Now compile the kernel (make dep; make clean; make bzImage; make modules; make modules_install) , etc. Again, it is beyond the scope of this HOWTO if you have problems compiling your kernel. Please see Section 2.8 for URLs to the KERNEL howto, etc. • You will then have move over the kernel binary, update your bootloader (LILO, Grub, etc.), and reboot. If you have questions about kernel compiling, I highly recommend to consult some of the URLs above in this section. 3.3. Assigning Private Network IP Addresses to the Internal LAN Since all INTERNAL MASQed machines should NOT have official Internet assigned addressees, there must be a specific and accepted way to allocate addresses to those machines without conflicting with anyone else's Internet address. From the original IP Masquerade FAQ: RFC 1918 is the official document on which IP addresses are to be used in a non−connected or "private" network. There are 3 blocks of numbers set aside specifically for this purpose. Section 3: Private Address Space Linux IP Masquerade HOWTO The Internet Assigned Numbers Authority (IANA) has reserved the following three blocks of the IP address space for private networks: 10.0.0.0 − 10.255.255.255 172.16.0.0 − 172.31.255.255 192.168.0.0 − 192.168.255.255 Chapter 3. Setting Up IP Masquerade 35
Linux IP Masquerade HOWTO We will refer to the first block as "24−bit block", the second as "20−bit block", and the third as "16−bit" block". Note that the first block is nothing but a single class A network number, while the second block is a set of 16 continuous class B network numbers, and the third block is a set of 255 continuous class C network numbers. For the record, my preference is to use the 192.168.0.0 network with a 255.255.255.0 Class−C subnet mask and thus this HOWTO reflects this. Any of the above private networks are valid, but just be SURE to use the correct subnet−mask. So, if you're using a Class−C network, you should number your TCP/IP enabled machines as 192.168.0.1, 192.168.0.2, 192.168.0.3, .., 192.168.0.x 192.168.0.1 is usually set as the internal gateway or Linux MASQ machine which reaches the external network. Please note that 192.168.0.0 and 192.168.0.255 are the Network and Broadcast address respectively (these addresses are RESERVED). Avoid using these addresses on your machines or your network will not function properly. 3.4. Configuring IP Forwarding Policies At this point, you should have your kernel and other required packages installed. All network IP addresses, gateway, and DNS addresses should be configured on your Linux MASQ server. If you don't know how to configure your Linux network cards, please consult the HOWTOs listed in either the 2.4.x Section 2.6, the 2.2.x Section 2.7, or the 2.0.x Section 2.8. Now, the only thing left to do is to configure the IP firewalling tools to both FORWARD and MASQUERADE the appropriate packets to the correct machine. ** This section ONLY provides the user with the bare minimum firewall ruleset to get IP Masquerading working. Once IP MASQ has been successfully tested (as described later in this HOWTO), please refer to the Stronger IPTABLES ruleset for 2.4.x kernels in Section 6.4.1, the Stronger IPCHAINS ruleset for 2.2.x kernels in Section 6.4.2, and the Stronger IPFWADM ruleset for 2.0.x kernels in Section 6.4.3. Please note that these stronger firewall rulesets are more of a template than anything else. For truly secure firewall rulesets, check out the the requirements section of the HOWTO ( 2.4.x − Section 2.6, 2.2.x − Section 2.7, 2.0.x − Section 2.8 ). Instead of manually typing one of these files by hand, I recommend to simply browse the Example directory or download an archive of all of these rc.firewall−* files. 3.4.1. Configuring IP Masquerade on Linux 2.6.x and 2.4.x Kernels Please note that IPCHAINS is no longer the primary firewall configuration tool for the 2.6.x and 2.4.x kernels. The new kernels now use the IPTABLES toolkit though the new 2.4.x kernels CAN still run most old IPCHAINS or IPFWADM rulesets via a compatiblity module. It should also be noted that when running in this compatibility mode, NO IPTABLES modules can be loaded. The reason for this is that none of the 2.2.x IPMASQ modules are compatible with 2.4.x kernels. For a more detailes for these changes, please see the Section 7.40 section. Chapter 3. Setting Up IP Masquerade 36
Page 1 and 2: Linux IP Masquerade HOWTO David A.
Page 3 and 4: Linux IP Masquerade HOWTO Table of
Page 5 and 6: Linux IP Masquerade HOWTO Table of
Page 7 and 8: Masquerade Resource web page. If yo
Page 9 and 10: Linux IP Masquerade HOWTO IP Masque
Page 11 and 12: | | : | C−box |:::::: | |.4 +−
Page 13 and 14: • Netfilter is an entirely new ar
Page 15 and 16: HOWTO. • Loadable kernel modules,
Page 17 and 18: • Linux IP Masquerade HOWTO havin
Page 19 and 20: ◊ ip_masquerade ip_conntrack ip_t
Page 21 and 22: commands might look different. It i
Page 23 and 24: cp extensions/libipt_esp.so /usr/lo
Page 25 and 26: [ Code maturity level options ] * P
Page 27 and 28: Linux IP Masquerade HOWTO * FTP pro
Page 29 and 30: (2.2.x kernels) and enable this opt
Page 31 and 32: • NOTE: Please notice that it isn
Page 33 and 34: Linux IP Masquerade HOWTO * Network
Page 35 and 36: == (Slow CPU, Telephony, SCSI, I2O,
Page 37 and 38: Please note the YES or NO ANSWERS t
Page 39: * IP: IPSEC masq debugging (DEBUG_I
Page 43 and 44: # #IPTABLES=/sbin/iptables IPTABLES
Page 45 and 46: #Loads the IRC NAT functionality in
Page 47 and 48: $IPTABLES −A FORWARD −j LOG ech
Page 49 and 50: esac 2. Slackware: • exit 1 exit
Page 51 and 52: Linux IP Masquerade HOWTO FWVER="1.
Page 53 and 54: Linux IP Masquerade HOWTO #CRITICAL
Page 55 and 56: this, copy the following file into
Page 57 and 58: Linux IP Masquerade HOWTO echo "Loa
Page 59 and 60: # Load all required IP MASQ modules
Page 61 and 62: # #/sbin/ipfwadm −I −a accept
Page 63 and 64: Slackware: • mlist) $IPFWADM −M
Page 65 and 66: Chapter 4. Configuring the other in
Page 67 and 68: 4.2. Configuring Windows NT Linux I
Page 69 and 70: 8. Linux IP Masquerade HOWTO gatewa
Page 71 and 72: USE DEFAULTS = OFF VLM = CONN.VLM V
Page 73 and 74: Chapter 5. Testing IP Masquerade Fi
Page 75 and 76: Linux IP Masquerade HOWTO −−−
Page 77 and 78: Linux IP Masquerade HOWTO . . PPP:
Page 79 and 80: −−−−−−−−−−−
Page 81 and 82: Linux IP Masquerade HOWTO 5.12. Any
Page 83 and 84: all IRC clients on various supporte
Page 85 and 86: 6.3.2. Clients that do not have ful
Page 87 and 88: # just leave this section alone. #
Page 89 and 90: Linux IP Masquerade HOWTO # Enabled
Page 91 and 92:
echo "1" > /proc/sys/net/ipv4/ip_fo
Page 93 and 94:
# STATEFULLY TRACKED # $IPTABLES
Page 95 and 96:
echo −e "\nrc.firewall−iptables
Page 97 and 98:
INTNET="192.168.0.0/24" echo " Inte
Page 99 and 100:
# # Make sure the EXTIF variable ab
Page 101 and 102:
# −−−−− Begin OPTIONAL FO
Page 103 and 104:
#!/bin/sh # # /etc/rc.d/rc.firewall
Page 105 and 106:
# If you get your TCP/IP address a
Page 107 and 108:
#End of file. To automatically sta
Page 109 and 110:
Linux IP Masquerade HOWTO #Enable i
Page 111 and 112:
• 2.6.x and 2.4.x kernels have PO
Page 113 and 114:
look something like this: /sbin/ins
Page 115 and 116:
If I use: > > ipmasqadm portfw −a
Page 117 and 118:
If you plan on port forwarding FTP
Page 119 and 120:
SOCKS: Finally, your last and possi
Page 121 and 122:
Linux IP Masquerade HOWTO 6.10. Gam
Page 123 and 124:
Chapter 7. Frequently Asked Questio
Page 125 and 126:
Linux IP Masquerade HOWTO 7.3. ( Er
Page 127 and 128:
Linux IP Masquerade HOWTO MASQ: IP
Page 129 and 130:
♦ correct rc.firewall−* name fo
Page 131 and 132:
The reason is because you have a dy
Page 133 and 134:
Linux IP Masquerade HOWTO rc.firewa
Page 135 and 136:
*** If you know how to also change
Page 137 and 138:
type=DWORD name="MaxMSS" (Do NOT in
Page 139 and 140:
All interface types: So, in your PP
Page 141 and 142:
like: −−−−−−−−−
Page 143 and 144:
Linux IP Masquerade HOWTO − IPTAB
Page 145 and 146:
7.21. ( Log Reduction ) − My logs
Page 147 and 148:
7.26. ( IDENT ) − IRC won't work
Page 149 and 150:
• Idea #3: Say you want to log al
Page 151 and 152:
Linux IP Masquerade HOWTO 7.34. ( N
Page 153 and 154:
The "iprule" and "iproute" commands
Page 155 and 156:
There are several things you should
Page 157 and 158:
available at the Linux IP Masquerad
Page 159 and 160:
8.3. Thanks to the following suppor
Page 161 and 162:
this one. • 05/21/05 − Updated
Page 163 and 164:
• 05/24/03: Updated the 2.4 Requi
Page 165 and 166:
Linux IP Masquerade HOWTO • 08/25
Page 167 and 168:
• − Load the FTP nat modules no
Page 169 and 170:
• Updated the comments in the 2.0
Page 171 and 172:
• Added Mandrake 6.0, 6.1, 7.0 to
Page 173:
Linux IP Masquerade HOWTO • In th
show all

Linux IP Masquerade HOWTO - The Linux Documentation Project

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?