Masquerade rules are a special class of filtering rule. You can
masquerade only datagrams that are received on one interface that will
be routed to another interface. To configure a masquerade rule you
construct a rule very similar to a firewall forwarding rule, but with
special options that tell the kernel to masquerade the datagram. The
ipfwadm command uses the -m
option, ipchains uses
-j MASQ, and iptables uses
-j MASQUERADE to
indicate that datagrams matching the rule specification should be
Let’s look at an example. A computing science student at Groucho Marx University has a number of computers at home internetworked onto a small Ethernet-based local area network. She has chosen to use one of the reserved private Internet network addresses for her network. She shares her accomodation with other students, all of whom have an interest in using the Internet. Because student living conditions are very frugal, they cannot afford to use a permanent Internet connection, so instead they use a simple dial-up PPP Internet connection. They would all like to be able to share the connection to chat on IRC, surf the Web, and retrieve files by FTP directly to each of their computers—IP masquerade is the answer.
The student first configures a Linux machine to support the dial-up link and to
act as a router for the LAN. The IP address she is assigned when she dials up
isn’t important. She configures the Linux router with IP masquerade and uses
one of the private network addresses for her LAN:
192.168.1.0. She ensures that each of the hosts on the
LAN has a default route pointing at the Linux router.
The following ipfwadm commands are all that are required to make masquerading work in her configuration:
ipfwadm -F -p deny#
ipfwadm -F -a accept -m -S 192.168.1.0/24 -D 0/0
or with ipchains:
ipchains -P forward -j deny#
ipchains -A forward -s 192.168.1.0/24 -d 0/0 -j MASQ
or with iptables:
iptables -t nat -P POSTROUTING DROP#
iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
Now whenever any of the LAN hosts try to connect to a service on a remote host, their datagrams will be automatically masqueraded by the Linux masquerade router. The first rule in each example prevents the Linux machine from routing any other datagrams and also adds some security.
To list the rule we created earlier we use:
ipfwadm -F -l -e
which should display something like:
ipfwadm -F -l -eIP firewall forward rules, default policy: accept pkts bytes type prot opt tosa tosx ifname ifaddress ... 0 0 acc/m all ---- 0xFF 0x00 any any ...
/m" in the output indicates this is a
To list the masquerade rules with the ipchains command, use the -L argument. If we list the rule we created earlier with ipchains, the output will look like:
# ipchains -LChain input (policy ACCEPT): Chain forward (policy ACCEPT): target prot opt source destination ports MASQ all ------ 192.168.1.0/24 anywhere n/a Chain output (policy ACCEPT):
Any rules with a target of
MASQ are masquerade rules.
Finally, to list the rules using iptables you need to use:
iptables -t nat -LChain PREROUTING (policy ACCEPT) target prot opt source destination Chain POSTROUTING (policy DROP) target prot opt source destination MASQUERADE all -- anywhere anywhere MASQUERADE Chain OUTPUT (policy ACCEPT) target prot opt source destination
Again, masquerade rules appear with a target of
When each new connection is established, the IP masquerade software
creates an association in memory between each of the hosts involved in
the connection. You can view these associations at any time by
looking at the
These associations will timeout after a period of inactivity, though.
ipfwadm -M -s <
ipchains -M -S <
The iptables implementation uses much longer default timers and does not allow you to set them.
Each of these values represents a timer used by the IP masquerade software and are in units of seconds. The following table summarizes the timers and their meanings:
TCP session timeout. How long a TCP connection may remain idle before the association for it is removed.
TCP timeout after FIN. How long an association will remain after a TCP connection has been disconnected.
UDP session timeout. How long a UDP connection may remain idle before the association for it is removed.