Linux Network Administratoramp;#039;s Guide (3rd Edition) [Electronic resources] نسخه متنی

9.3. Configuring IP Masquerade

If
you've already read the firewall and accounting
chapters, it probably comes as no surprise that the
iptables command is used to configure the IP
masquerade rules as well.

Masquerading is a special type
of packet mangling (the technical term for
modifying packets). You can masquerade only packets that are received
on one interface that will be routed to another interface. To
configure a masquerade rule, construct a rule very similar to a
firewall forwarding rule, but with special options that tell the
kernel to masquerade the packet. The iptables
command uses -j
MASQUERADE to indicate that packets matching the
rule specification should be masqueraded (this is for a dynamic IP
address; if you have a static IP address, use -j
SNAT instead).

Let's look at an example.
A computing science student at Groucho Marx University has a number
of computers at home on a small Ethernet-based LAN. She has chosen to
use one of the reserved private Internet network addresses for her
network. She shares her accommodation with other students, all of
whom have an interest in using the Internet. Because the
students' finances are very tight, they cannot
afford to use a permanent Internet connection, so instead they use a
single Internet connection. They would all like to be able to share
the connection to chat on IRC, surf the Web, and retrieve files by
FTP directly to each of their computersIP masquerade is the
answer.

The student first configures a Linux host to support the Internet
link and to act as a router for the LAN. The IP address she is
assigned when she dials up isn't important. She
configures the Linux router with IP masquerade and uses one of the
private network addresses for her LAN: 192.168.1.0. She ensures that each of the
hosts on the LAN has a default route pointing at the Linux router.

The following
iptables commands are all that are required to
make masquerading work in her configuration:

# iptables -t nat -P POSTROUTING DROP
# iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE

Now whenever any of the LAN hosts try to connect to a service on a
remote host, their packets will be automatically masqueraded by the
Linux masquerade router. The first rule in each example prevents the
Linux host from routing any other packets and also adds some
security.

To
list the masquerade rules you have created, use the
-L argument to the iptables
command, as we described earlier while discussing firewalls:

# iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         
Chain POSTROUTING (policy DROP)
target     prot opt source               destination         
MASQUERADE  all  --  anywhere             anywhere           MASQUERADE 
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Masquerade rules appear with a
target of MASQUERADE.