Linux IP Masquerade HOWTO

• Index
• Introduction
• Introduction to IP Masquerading or IP MASQ
• Foreword, Feedback Credits
• Copyright Disclaimer
• Background Knowledge
• What is IP Masquerade?
• Current Status
• Who Can Benefit From IP Masquerade?
• Who Doesn't Need IP Masquerade?
• How does IP Masquerade Work?
• Requirements for IP Masquerade on Linux 2.4.x
• Requirements for IP Masquerade on Linux 2.2.x
• Requirements for IP Masquerade on Linux 2.0.x
• Setting Up IP Masquerade
• Compiling a new kernel if needed
• Checking your existing kernel for MASQ functionality
• Assigning Private Network IP Addresses to the Internal LAN
• Configuring IP Forwarding Policies
• Configuring the other internal to-be MASQed machines
• Configuring Microsoft Windows 95 and OSR2
• Configuring Windows NT
• Configuring Windows for Workgroup 3.11
• Configuring UNIX Based Systems
• Configuring DOS using NCSA Telnet package
• Configuring MacOS Based System Running MacTCP
• Configuring MacOS Based System Running Open Transport
• Configuring Novell network using DNS
• Configuring OS/2 Warp
• Configuring OS/400 on a IBM AS/400
• Configuring Other Systems
• Testing IP Masquerade
• Loading up the rc.firewall ruleset
• Testing internal MASQ client PC connectivity
• Testing internal MASQ client to MASQ server connectivity
• Testing internal MASQ server connectivity
• Testing internal MASQ server to MASQ client connectivity
• Testing External MASQ server Internet connectivity
• Testing internal MASQ client to external MASQ server connectivity
• Testing external MASQ ICMP forwarding
• Testing MASQ functionality without DNS
• Testing MASQ functionality with DNS resolution
• Testing more MASQ functionality with DNS
• Any remaining functional, performance, etc. issues...
• Other IP Masquerade Issues and Software Support
• Problems with IP Masquerade
• Incoming services
• Supported Client Software and Other Setup Notes
• Stronger firewall rulesets to run after initial testing
• IP Masquerading multiple internal networks
• IP Masquerade and Dial-on-Demand Connections
• Port Forwarding with IPTABLES or external tools like IPPORTFW, IPMASQADM, IPAUTOFW, REDIR, UDPRED,
• CU-SeeMe and Linux IP-Masquerade
• Mirabilis ICQ
• Gamers: The LooseUDP patch
• Frequently Asked Questions
• ( Distro ) - What Linux Distributions support IP Masquerading?
• ( Requirements ) - What are the minimum hardware requirements and any limitations for IP Masquerade
• ( Errors ) - When I run my specific rc.firewall-* ruleset, I get "command not found" errors. Why?
• ( Still wont work ) - I've checked all my configurations, I still can't get IP Masquerade to work.
• ( Email list ) - How do I join or view the IP Masquerade and/or IP Masqurade Developers mailing lis
• ( NAT vs. Proxy ) - How does IP Masquerade differ from Proxy or NAT services?
• ( GUI ) - Are there any GUI firewall creation/management tools?
• ( MASQ and Dynamic IPs ) - Does IP Masquerade work with dynamically assigned IP addresses?
• ( MASQ and various networks ) - Can I use a cable modem (both bi-directional and with modem returns
• ( Dial on Demand ) - Can I use Diald or the Dial-on-Demand feature of PPPd with IP MASQ?
• ( Apps ) - What applications are supported with IP Masquerade?
• ( Distro Setup ) - How can I get IP Masquerade running on Redhat, Debian, Slackware, etc.?
• ( Timeouts ) - Connections seem to break if I don't use them often. Why is that?
• ( Odd Behavior ) - When my Internet connection first comes up, nothing works. If I try again, ever
• ( MTU ) - IP MASQ seems to be working fine but some sites don't work. This usually happens with WW
• ( FTP ) - MASQed FTP clients don't work.
• ( Performance ) - IP Masquerading seems slow
• ( PORTFW ) - IP Masquerading with PORTFWing seems to break when my line is idle for long periods
• ( PORTFW - Locally ) - I can't reach my PORTFWed server from the INTERNAL lan
• ( Logs ) - Now that I have IP Masquerading up, I'm getting all sorts of weird notices and errors in
• ( Log Reduction ) - My logs are filling up with packet hits due to the new "stronger" rulesets. Ho
• ( MASQ Security ) - Can I configure IP MASQ to allow Internet users to directly contact internal MA
• ( Free Ports ) - I'm getting "kernel: ip_masq_new(proto=UDP): no free ports." in my SYSLOG files.
• ( SETSOCKOPT ) - I'm getting "ipfwadm: setsockopt failed: Protocol not available" when I try to use
• ( SAMBA ) - Microsoft File and Print Sharing and Microsoft Domain clients don't work through IP Mas
• ( IDENT ) - IRC won't work properly for MASQed IRC users. Why?
• ( IRC DCC ) - mIRC doesn't work with DCC Sends
• ( IP Aliasing ) - Can IP Masquerade work with only ONE Ethernet network card?
• ( Multiple-LANs ) - I have two MASQed LANs but they cannot communicate with each other!
• ( SHAPING ) - I want to be able to limit the speed of specific types of traffic
• ( ACCOUNTING ) - I need to do accounting on who is using the network
• ( MULTIPLE IPs - DMZ segments) - I have several EXTERNAL IP addresses that I want to PORTFW to seve
• ( 1:1 NAT ) - I'd like to do 1:1 NAT but I can't figure out how to do it
• ( Netstat ) - I'm trying to use the NETSTAT command to show my Masqueraded connections but its not
• ( VPNs ) - I would like to get Microsoft PPTP (GRE tunnels) and/or IPSEC (Linux SWAN) tunnels runni
• ( Games ) - I want to get the XYZ network game to work through IP MASQ but it won't work. Help!
• ( Stops working ) - IP MASQ works fine for a while but then it stops working. A reboot seems to fi
• ( SMTP Relay ) - Internal MASQed computers cannot send SMTP or POP-3 mail!
• ( Source Routing ) - I need different internal MASQed networks to exit on different external IP add
• ( IPCHAINS rulesets on 2.4.x kernels ) - What the ipchains.o module can do on 2.4.x kernels
• ( IPTABLES vs. IPCHAINS vs. IPFWADM ) - Why do the 2.4.x, 2.2.x, and 2.0.x kernels use different fi
• ( Upgrades ) - I've just upgraded to the x.y.z kernel, why isn't IP Masquerade working?
• ( EQL ) - I need help with EQL connections and IP Masq
• ( Wussing out ) - I can't get IP Masquerade to work! What options do I have for Windows Platforms?
• ( Developers ) - I want to help with IP Masquerade development. What can I do?
• ( More INFO ) - Where can I find more information on IP Masquerade?
• ( Translators ) - I want to translate this HOWTO to another language, what should I do?
• ( Updates ) - This HOWTO seems out of date, are you still maintaining it? Can you include more inf
• ( Thanks ) - I got IP Masquerade working, it's great! I want to thank you guys, what can I do?
• Miscellaneous
• Useful Resources
• Linux IP Masquerade Resource
• Thanks to the following supporters..
• Reference
• ChangeLOG