Masquerading-Simple-HOWTO(1).pdf

Masquerading Made Simple HOWTO

John Tapsell

< tapselj0@cs.man.ac.uk>

Thomas Spellman

< thomasNO@SPAMresonancePLEASE.org >

Matthias Grimm

< DeadBull@gmx.net>

Revision History

Revision 0.09

2004−07−21

Revised by: ts

Revision 0.08

2002−07−11

Revised by: jpt

Revision 0.07

2002−02−27

Revised by: jpt

Revision 0.06

2001−09−08

Revised by: jpt

Revision 0.05

2001−09−07

Revised by: jpt

Revision 0.04

2001−09−01

Revised by: jpt

Revision 0.03

2001−07−06

Revised by: jpt

All of the authors are available on #debian on irc.opensource.net

John Tapsell (JohnFlux) is the official maintainer.

Email me (John Tapsell) for any query, flame, feedback, a date, etc.

Shamelessly stealing from David Ranch's work − < dranch@trinnet.net> .

This is NOT a replacement for the IP−Masquerading HOWTO − it is to complement it, and the two should be

read side by side. I do not include things in here that are covered by the the other HOWTO, nor do I explain

what it all means, or what it is all about. See http://ipmasq.cjb.net and the standard Masq−HOWTO for a

much better guides.

This document describes how to enable the Linux IP Masquerade feature on a given Linux host. IP Masq is a

form of Network Address Translation or NAT that allows internally networked computers that do not have

one or more registered Internet IP addresses to have the ability to communicate to the Internet via your Linux

boxes single Internet IP address.

This is all under the GNU Free Documentation License

http://www.gnu.org/copyleft/fdl.html

Masquerading Made Simple HOWTO

Table of Contents

1. Introduction. ....................................................................................................................................................1

2. Summary: (I like doing summaries first. .....................................................................................................2

3. Bitmore indepth version. ................................................................................................................................3

4. Post−install Instructions. ................................................................................................................................5

5. FAQ's − Frequently Asked Compla^H^H^H^H^H^H Questions. ...........................................................6

1. Introduction

This is intentionally short and to the point.

If you have a network, that you want to attach to the outside:

1. Introduction

2. Summary: (I like doing summaries first)

Assuming external internet card is eth0, and external IP is 123.12.23.43 and the internal network card is eth1,

then:

$> modprobe ipt_MASQUERADE # If this fails, try continuing anyway

$> iptables −F; iptables −t nat −F; iptables −t mangle −F

$> iptables −t nat −A POSTROUTING −o eth0 −j SNAT −−to 123.12.23.43

$> echo 1 > /proc/sys/net/ipv4/ip_forward

Or for a dial−up connection:

$> modprobe ipt_MASQUERADE # If this fails, try continuing anyway

$> iptables −F; iptables −t nat −F; iptables −t mangle −F

$> iptables −t nat −A POSTROUTING −o ppp0 −j MASQUERADE

$> echo 1 > /proc/sys/net/ipv4/ip_forward

Then to secure it:

$> iptables −A INPUT −m state −−state ESTABLISHED,RELATED −j ACCEPT

$> iptables −A INPUT −m state −−state NEW −i ! eth0 −j ACCEPT

$> iptables −P INPUT DROP #only if the first two are succesful

$> iptables −A FORWARD −i eth0 −o eth0 −j REJECT

Or for a dial−up connection (with eth0 as the internal network card):

$> iptables −A INPUT −m state −−state ESTABLISHED,RELATED −j ACCEPT

$> iptables −A INPUT −m state −−state NEW −i ! ppp0 −j ACCEPT

$> iptables −P INPUT DROP #only if the first two are succesful

$> iptables −A FORWARD −i ppp0 −o ppp0 −j REJECT

And thats it! To view the rules do " iptables −t nat −L "

2. Summary: (I like doing summaries first)

Plik z chomika:

Inne pliki z tego folderu:

Inne foldery tego chomika: