[vox-tech] Re: Masquerading
vox-tech@lists.lugod.org
vox-tech@lists.lugod.org
Fri, 15 Mar 2002 13:44:08 +0000
whoa, whoa, whoa....
If he's using RedHat 7.2, then he's using the 2.4 kernel
so the firewall solutions listed below may not work.
With the 2.4 kernel there is an option to quit using the
ipchains and move on to the new and improved iptables.
First step, type "iptables -L" then "ipchains -L" one of
these will work and one will return an error. This will
determine how to setup the firewall. Iptables has a
completly differant flow than ipchains. You set up
Nat/masq in a differant place.
Also with newer distro's it is not necessary to use
ifconfig commands in the scripts. Simply set up the
network to point to the appropriate places. This will
eliminate future confussion when dealing with network
settings (hmm... the /etc/sysconfig/networking/ifup-eth0
file has the correct config but nothing's working... I
wonder where else I might have messed with the settings.
Let's start grepping through all my scripts to figure
out what's up).
Martyn, If you can tell me which of the above commands
work, I'll show you a script.
BTW I agree with all other points below. You should set
up the firewall that blocks all traffic then start
allowing specific traffic. Being on DSL and/or Cable
broadband with no firewall is asking for trouble.
> On Thu, 14 Mar 2002, Peter Jay Salzman wrote:
>
> > martyn,
> >
> > it's been a long while since i've done masquerading by hand (how
> > embarrasing!) but off the top of my head, do this:
>
> Been awhile for me too... :) scripts spoil me.... even ones I have
> written.
>
> > on linux:
> >
> > point your DNS to your ISP's DNS servers (/etc/resolv.conf)
> >
> > # bring up the interfaces
> > ifconfig eth0 external-ip up
> > ifconfig eth1 192.168.0.1 up
> > # set up routing
> > route add default gateway your-ISP-gateway
> > # set a default policy for the forwarding chain
> > /sbin/ipchains -P forward DENY
> > # enable the masquerading
> > echo "1" > /proc/sys/net/ipv4/ip_forward
>
> > # do the masquerading
> > /sbin/ipchains -A forward -s 192.168.0.2 -j MASQ -i eth0
> > /sbin/ipchains -A forward -s 192.168.0.3 -j MASQ -i eth0
>
> This looks like it will work, but I'll throw in some comments
> anyway:
>
> a) this masquerades exactly two internal machines out the door. To masq
> all computers on your internal network, use
> /sbin/ipchains -A forward -s 192.168.0.0/24 -j MASQ -i eth0
> which says any ip beginning with 192.168.0 can get out.
>
> b) note that each ipchains command is incremental... if you don't
> get it right the first time, you will need to remove your
> mistake from the ruleset. I find the easiest way is to edit
> a script that clears the whole thing and builds the whole
> ruleset from scratch, so you know every rule is in the right
> place.
>
> In a more general vein...
>
> c) I highly recommend the use of a firewall script. ADSL means
> you are subject to continuous bombardment. I don't know
> anything about "Firestarter", but you need something.
> Seawall (kernel 2.2), Shorewall (kernel 2.3), and rcf (I think
> 2.2) seem to be well regarded. I use a custom one I modified off the
> net.
>
> d) Don't ever let anyone telnet into your machine... disable
> all external access via telnet, because it can be
> sniffed. Use ssh instead... preferably protocol version
> 2 or better (OpenSSH 3.1p1 or better). I actually think
> the telnet daemon should be turned off... ssh is more convenient
> even within your LAN.
>
> e) Be sure to understand every service you allow the outside
> world to use. In particular, be careful of any CGIs you
> allow to be enabled in a web server.
>
> >
> > on windows:
> > point your DNS at your ISP's DNS servers
> > use 192.168.0.1 as your gateway.
> > (i don't use windows, so i don't know how you do this)
> >
> > i've cc'd vox-tech just in case i screwed up. i'm sure someone will
> > correct me in minutes. :-)
> >
> > btw, vox-techers, please cc this guy since he's not on the mailing list.
> >
> > if you use linux, please consider coming to our meetings.
> > www.lugod.org. we gladly accept donations to help fund demos,
> > installfests and our lending library.
> >
> > pete
> >
> > begin Martyn R Whittaker <martyn.whittaker@virgin.net>
> > > Dear Root,
> > >
> > > I wonder if any of your members would like to do a one or two hours
> > > of consulting for me?
> > >
> > > I have set up RedHat Linux 7.2 on my qateway machine at home which
> > > contains 2 ethernet cards that seem to be loading up and working fine.
> > > Eth0 is connected to static IP address (ADSL) and Eth1(192.168.0.1) is
> > > connected to my home network of 2 Windows PCS (192.168.0.2 and
> > > 192.168.0.3)
> > >
> > > I have tried using the Firestarter firewall and also setting up a
> > > simple forwarding and masquerading firewall so that I can access the
> > > Internet, email etc from my client PCs but without success. Pinging
> > > works fine.
> > >
> > > I suspect someone who knows what they are doing could telnet on to
> > > my machine or come round and sort this really quickly.
> > >
> > > I wonder if you could ask your members if anyone would be interested?
> > >
> > > Regards
> > >
> > > Martyn R. Whittaker
> > > 317 Encina Ave., Davis, CA 95616 USA
> > > p. +1 530 756 2867 f. +1 253 498 9591 m. +1 916 813 7061
>
> ---------------------------------------------------------------------------
> Jeff Newmiller The ..... ..... Go Live...
> DCN:<jdnewmil@dcn.davis.ca.us> Basics: ##.#. ##.#. Live Go...
> Live: OO#.. Dead: OO#.. Playing
> Research Engineer (Solar/Batteries O.O#. #.O#. with
> /Software/Embedded Controllers) .OO#. .OO#. rocks...2k
> ---------------------------------------------------------------------------
>
>
>
> _______________________________________________
> vox-tech mailing list
> vox-tech@lists.lugod.org
> http://lists.lugod.org/mailman/listinfo/vox-tech