If your private network contains any vital information, think carefully before using IP Masquerade. This may be a GATEWAY for you to get to the Internet, and vice versa for someone on the other side of the world to get into your network.
If your Linux distribution already has the required features and modules compiled (most modular kernels will have all you need) mentioned below, then you do not have to re-compile the kernel. Reading this section is still highly recommended as it contains other useful informaiton.
/usr/src/ with a command: tar xvzf linux-2.2.x.tar.gz -C /usr/src, where x is the patch level beyond 2.0linux )
Say YES to the following,
* Prompt for development and/or incomplete code/drivers
CONFIG_EXPERIMENTAL
- this will allow you to select experimental IP Masquerade code compiled
into the kernel
* Enable loadable module support
CONFIG_MODULES
- allows you to load ipmasq modules such as ip_masq_ftp.o
* Networking support
CONFIG_NET
* Network firewalls
CONFIG_FIREWALL
* TCP/IP networking
CONFIG_INET
* IP: forwarding/gatewaying
CONFIG_IP_FORWARD
* IP: firewalling
CONFIG_IP_FIREWALL
* IP: masquerading
CONFIG_IP_MASQUERADE
* IP: ipportfw masq support
CONFIG_IP_MASQUERADE_IPPORTFW
- recommended
* IP: ipautofw masquerade support
CONFIG_IP_MASQUERADE_IPAUTOFW
- optional
* IP: ICMP masquerading
CONFIG_IP_MASQUERADE_ICMP
- support for masquerading ICMP packets, recommended.
* IP: always defragment
CONFIG_IP_ALWAYS_DEFRAG
- highly recommended
* Dummy net driver support
CONFIG_DUMMY
- recommended
* IP: ip fwmark masq-forwarding support
CONFIG_IP_MASQUERADE_MFW
- optional
NOTE: These are just the component you need for IP Masquerade, select whatever other options you need for your specific setup.
make modules; make modules_install
/etc/rc.d/rc.local file (or any file you think is appropriate) to load the required modules reside in /lib/modules/2.2.x/ipv4/ automatically during each reboot:
.
.
.
/sbin/depmod -a
/sbin/modprobe ip_masq_ftp
/sbin/modprobe ip_masq_raudio
/sbin/modprobe ip_masq_irc
(and other modules such as ip_masq_cuseeme, ip_masq_vdolive
if you have applied the patches)
.
.
.
echo "1" > /proc/sys/net/ipv4/ip_forwarding
For Redhat users, you may try changing FORWARD_IPV4=false to FORWARD_IPV4=true in /etc/sysconfig/network
/usr/src/ with a command: tar xvzf linux-2.0.x.tar.gz -C /usr/src, where x is the patch level beyond 2.0linux )
Say YES to the following,
* Prompt for development and/or incomplete code/drivers
CONFIG_EXPERIMENTAL
- this will allow you to select experimental IP Masquerade code compiled
into the kernel
* Enable loadable module support
CONFIG_MODULES
- allows you to load modules
* Networking support
CONFIG_NET
* Network firewalls
CONFIG_FIREWALL
* TCP/IP networking
CONFIG_INET
* IP: forwarding/gatewaying
CONFIG_IP_FORWARD
* IP: firewalling
CONFIG_IP_FIREWALL
* IP: masquerading (EXPERIMENTAL)
CONFIG_IP_MASQUERADE
- although it is experimental, it is a *MUST*
* IP: ipautofw masquerade support (EXPERIMENTAL)
CONFIG_IP_MASQUERADE_IPAUTOFW
-recommended
* IP: ICMP masquerading
CONFIG_IP_MASQUERADE_ICMP
- support for masquerading ICMP packets, optional.
* IP: always defragment
CONFIG_IP_ALWAYS_DEFRAG
- highly recommended
* Dummy net driver support
CONFIG_DUMMY
- recommended
NOTE: These are just the component you need for IP Masquerade, select whatever other options you need for your specific setup.
make modules; make modules_install
/etc/rc.d/rc.local file (or any file you think is appropriate) to load the required modules reside in /lib/modules/2.0.x/ipv4/ automatically during each reboot:
.
.
.
/sbin/depmod -a
/sbin/modprobe ip_masq_ftp
/sbin/modprobe ip_masq_raudio
/sbin/modprobe ip_masq_irc
(and other modules such as ip_masq_cuseeme, ip_masq_vdolive
if you have applied the patches)
.
.
.
echo "1" > /proc/sys/net/ipv4/ip_forward
For Redhat users, you may try changing FORWARD_IPV4=false to FORWARD_IPV4=true in /etc/sysconfig/network
Since all OTHER machines do not have official assigned addressees, there must be a right way to allocate address to those machines.
From IP Masquerade FAQ:
There is an RFC (#1597, probably obsolete by now) on which IP addresses are to be used on a non-connected network. There are 3 blocks of numbers set aside specifically for this purpose. One which I use is 255 Class-C subnets at 192.168.1.n to 192.168.255.n .
From RCF 1597:
Section 3: Private Address Space
The Internet Assigned Numbers Authority (IANA) has reserved the
following three blocks of the IP address space for private networks:
10.0.0.0 - 10.255.255.255
172.16.0.0 - 172.31.255.255
192.168.0.0 - 192.168.255.255
We will refer to the first block as "24-bit block", the second as
"20-bit block", and to the third as "16-bit" block". Note that the
first block is nothing but a single class A network number, while the
second block is a set of 16 contiguous class B network numbers, and
third block is a set of 255 contiguous class C network numbers.
192.168.1.1 is usually the gateway machine, which is your Linux host connecting to the Internet. Notice that 192.168.1.0 and 192.168.1.255 are the Network and Broadcast address respectively, which are reserved. Avoid using these addresses on your machines.
Besides setting the appropriate IP address for each machine, you should also set the appropriate gateway. In general, it is rather straight forward. You simply enter the address of your Linux host (usually 192.168.1.1) as the gateway address.
For the Domain Name Service, you can add in any DNS available. The most apparent one should be the one that your Linux is using. You can optionally add any domain search suffix as well.
After you have reconfigured those IP addresses, remember to restart the appropriate services or reboot your systems.
The following configuration instructions assume that you are using a Class C network with 192.168.1.1 as your Linux host's address. Please note that 192.168.1.0 and 192.168.1.255 are reserved.
/etc/resolv.conf). Optionally, you can add the appropriate domain search suffix.
Ping the linux box to test the network connection: 'Start/Run', type: ping 192.168.1.1ping the outside world yet.)
HOSTS file in the windows directory so that you can use hostname of the machines on your LAN. There is an example called HOSTS.SAM in the windows directory.
Ping the linux box to test the network connection: 'File/Run', type: ping 192.168.1.1ping the outside world yet.)
[1]Novell NE2000 Adapter. Then set the IP Address to 192.168.1.x (1 < x < 255), then set Subnet Mask to 255.255.255.0 and Default Gateway to 192.168.1.1
Ping the linux box to test the network connection: 'File/Run', type: ping 192.168.1.1ping the outside world yet.)
/etc/sysconfig/network-scripts/ifcfg-eth0 file on a Red Hat Linux system, or simply do it through the Control Panel. /etc/resolv.conf
/etc/networks file depending on your settings.
ping command: ping 192.168.1.1 to test the connection to your gateway machine.ping the outside world yet.)
nwpd 0x60 10 0x300, with your network card set to IRQ 10 and hardware address at 0x300
pkunzip tel2308b.zip
config.tel file
myip=192.168.1.x (1 < x < 255), and netmask=255.255.255.0
hardware=packet, interrupt=10, ioaddr=60
name=default
host=yourlinuxhostname
hostip=192.168.1.1
gateway=1
name=dns.domain.com ; hostip=123.123.123.123; nameserver=1
config.tel file
telnet 192.168.1.1
Hosts file in your System Folder so that you can use the hostnames of the machines on your LAN. The file should already exist in your System Folder, and should contain some (commented-out) sample entries which you can modify according to your needs.
Hosts file in your System Folder so that you can use the hostnames of the machines on your LAN. The file may or may not already exist in your System Folder. If so, it should contain some (commented-out) sample entries which you can modify according to your needs. If not, you can get a copy of the file from a system running MacTCP, or just create your own (it follows a subset of the Unix /etc/hosts file format, described on RFC952). Once you've created the file, open the TCP/IP control panel, click on the 'Select Hosts File...' button, and open the Hosts file.
edit c:\nwclient\startnet.bat: (here is a copy of mine)
SET NWLANGUAGE=ENGLISH LH LSL.COM LH KTC2000.COM LH IPXODI.COM LH tcpip LH VLM.EXE F:
edit c:\nwclient\net.cfg: (change link driver to yours i.e. NE2000)
Link Driver KTC2000
Protocol IPX 0 ETHERNET_802.3
Frame ETHERNET_802.3
Frame Ethernet_II
FRAME Ethernet_802.2
NetWare DOS Requester
FIRST NETWORK DRIVE = F
USE DEFAULTS = OFF
VLM = CONN.VLM
VLM = IPXNCP.VLM
VLM = TRAN.VLM
VLM = SECURITY.VLM
VLM = NDS.VLM
VLM = BIND.VLM
VLM = NWP.VLM
VLM = FIO.VLM
VLM = GENERAL.VLM
VLM = REDIR.VLM
VLM = PRINT.VLM
VLM = NETX.VLM
Link Support
Buffers 8 1500
MemPool 4096
Protocol TCPIP
PATH SCRIPT C:\NET\SCRIPT
PATH PROFILE C:\NET\PROFILE
PATH LWP_CFG C:\NET\HSTACC
PATH TCP_CFG C:\NET\TCP
ip_address xxx.xxx.xxx.xxx
ip_router xxx.xxx.xxx.xxx
c:\bin\resolv.cfg:
SEARCH DNS HOSTS SEQUENTIAL NAMESERVER 207.103.0.2 NAMESERVER 207.103.11.9
'ping 192.168.1.1' in a 'OS/2 Command prompt Window'. When ping
packets are received all is ok.
The same logic should apply to setting up other platforms. Consult the sections above. If you're interested in writing about any of systems that have not been covered yet, please send a detail setup instruction to and .
At this point, you should have your kernel and other required packages installed, as well as your modules loaded. Also, the IP addresses, gateway, and DNS should be all set on the OTHER machines.
Now, the only thing left to do is to use the IP firewalling tools to forward appropriate packets to the appropriate machine:
** This can be accomplished in many different ways. The following suggestions and examples worked for me, but you may have different ideas, please refer to section 4.4 and the ipchains(2.2.x) / ipfwadm(2.0.x) manpages for details. **
** This section ONLY provides you with the bare minimum rule set to get IP Masquerade working while security issue is not being considered. It is highly recomended that you spend some time to apply appropriate firewall rules to tighten security. **
ipfwadm is no longer the tool for manipulating ipmasq rules for 2.2.x kernels, please use ipchains.
ipchains -P forward DENY
ipchains -A forward -s yyy.yyy.yyy.yyy/x -j MASQ
netmask | x | Subnet
~~~~~~~~~~~~~~~~|~~~~|~~~~~~~~~~~~~~~
255.0.0.0 | 8 | Class A
255.255.0.0 | 16 | Class B
255.255.255.0 | 24 | Class C
255.255.255.255 | 32 | Point-to-point
You may also use the format yyy.yyy.yyy.yyy/xxx.xxx.xxx.xxx, where xxx.xxx.xxx.xxx specfies your subnet mask such as 255.255.255.0
For example, if I'm on a class C subnet, I would have entered:
ipchains -P forward DENY
ipchains -A forward -s 192.168.1.0/24 -j MASQ
or
ipchains -P forward DENY
ipchains -A forward -s 192.168.1.0/255.255.255.0 -j MASQ
You can also do it on a per machine basis. For example, if I want 192.168.1.2 and 192.168.1.8 to have access to the Internet, but not the other machines, I would have entered:
ipchains -P forward DENY
ipchains -A forward -s 192.168.1.2/32 -j MASQ
ipchains -A forward -s 192.168.1.8/32 -j MASQ
Do not make your default policy be masquerading - otherwise someone who can manipulate their routing will be able to tunnel straight back through your gateway, using it to masquerade their identity!
Again, you can add these lines to the /etc/rc.local files, one of the rc files you prefer, or do it manually every time you need IP Masquerade.
For detail ipchains usage, please refer to the Linux IPCHAINS HOWTO
ipfwadm -F -p deny
ipfwadm -F -a m -S yyy.yyy.yyy.yyy/x -D 0.0.0.0/0
or
ipfwadm -F -p deny
ipfwadm -F -a masquerade -S yyy.yyy.yyy.yyy/x -D 0.0.0.0/0
netmask | x | Subnet
~~~~~~~~~~~~~~~~|~~~~|~~~~~~~~~~~~~~~
255.0.0.0 | 8 | Class A
255.255.0.0 | 16 | Class B
255.255.255.0 | 24 | Class C
255.255.255.255 | 32 | Point-to-point
You may also use the format yyy.yyy.yyy.yyy/xxx.xxx.xxx.xxx, where xxx.xxx.xxx.xxx specfies your subnet mask such as 255.255.255.0
For example, if I'm on a class C subnet, I would have entered:
ipfwadm -F -p deny
ipfwadm -F -a m -S 192.168.1.0/24 -D 0.0.0.0/0
Since bootp request packets comes without valid IP's once the client knows nothing about it, for people with a bootp server in the masquerade/firewall machine it is necessary to use the following before the deny command:
ipfwadm -I -a accept -S 0/0 68 -D 0/0 67 -W bootp_clients_net_if_name -P udp
You can also do it on a per machine basis. For example, if I want 192.168.1.2 and 192.168.1.8 to have access to the Internet, but not the other machines, I would have entered:
ipfwadm -F -p deny
ipfwadm -F -a m -S 192.168.1.2/32 -D 0.0.0.0/0
ipfwadm -F -a m -S 192.168.1.8/32 -D 0.0.0.0/0
What appears to be a common mistake is to make the first command be this
ipfwadm -F -p masqueradeDo not make your default policy be masquerading - otherwise someone who can manipulate their routing will be able to tunnel straight back through your gateway, using it to masquerade their identity!
Again, you can add these lines to the /etc/rc.local files, one of the rc files you prefer, or do it manually every time you need IP Masquerade.
Please read section 4.4 for a detail guide on Ipfwadm
It's time to give it a try, after all these hard work. Make sure the connection of your Linux hosts to the Internet is okay.
You can try browsing some 'INTERNET!!!' web sites on your OTHER machines, and see if you get it. I recommend using an IP address rather than a hostname on your first try, because your DNS setup may not be correct.
For example, you can access the Linux Documentation Project site http://metalab.unc.edu/mdw/linux.html with an entry of http://152.19.254.81/mdw/linux.html
If you see The Linux Documentation Project homepage, then congratulations! It's working! You may then try one with hostname entry, and then ping, telnet, ssh, ftp, Real Audio, True Speech, whatever supported by IP Masquerade.....
So far, I have no trouble with the above settings, and it's full credit to the people who spend their time making this wonderful feature working.
  |