On Fri, 17 Dec 1999, Terry Collins wrote:
> Des Wass wrote:
>
> > > > Is it possible with ipchains to masquerade behind a static address?
> > > >
> > > > i.e. hide 192.168.1.20 behind 203.x.x.19
> > >
> > > Yes, that is what it is all about.
> > >
> > > My ISP provides me with the 203.x.x.x number and woa.com.au exists on
> > > 192.168.y.y numbers.
> > >
> > >From what I understand,
> >
> > ipchains -A forward -s 192.168.1.10 -d 0/0 -j MASQ
> >
> > will mask the 192.168.1.10 address behind 203.x.x.10. What I need to do is
> > mask 192.168.1.10 behind 203.x.x.43.
> >
> > If I do:
> > ipchains -A forward -b -s 192.168.1.10 -d 203.x.x.43 -j MASQ
> >
> > the address can only reach the external interface and cannot go further.
> >
> > I hope I'm coming across clearly enough.
>
> Unfortunately, I can not (yet) help you with ipchains. I'm one app
> behind, but I will run through some fundamentals. Others will no doubt
> help (HINT!).
For those struggling with ipchains, I can recommend that you looks for a
thing called Fwctl. It's a perl app which sits on a perl module IPChains
which drives the IPChains API, and another one called net-IPV4 which does
all the netmask/network/broadcast mangling. Fwctl itself has various
modules that understand protocols such as ftp and http. There is an alias
file where you can set up names for your DNS provider, upstream web cache
etc, then a rules file where you list your firewall rules in a pretty
straightforward manner, viz:
## Local traffic is OK
accept all -src LOCAL_IP -dst LOCAL_IP
## Count traffic that goes on the Internet
#account all -src INT_NET -dst INTERNET -name internet
##################################################################
## TRAFFIC CONTROL
#accept traffic_control -src INT_NET
#accept traffic_control -src INTERNET -account -name tf_internet
##################################################################
## NETWORK TROUBLESHOUTING
## Accept pings and traceroute from the Internet
## but logs it.
#accept ping -src INTERNET -dst EXT_IP -log -account -name
monitoring
#accept traceroute -src INTERNET -dst EXT_IP -log -account -name
monitoring
#accept ping -src INT_NET -dst INT_IP
#accept traceroute -src INT_NET -dst INT_IP
[etc]
Now, back to the original problem.
My understanding is that you can't masquerade locally generated packets -
they have to come in through an interface. But you don't have to anyway.
Even if your local net address is 192.168.x.x, when you fire up a PPP
link, your end of that link is 203.x.x.19. And unless your program insists
on using the 192.168.x.x address as the source address of outgoing
packets, they will go out with 203.x.x.19 as the source address. And that
seems to be what you are asking for...
Charlie Brady
Aurema Pty Ltd
PO Box 305, Strawberry Hills, NSW 2012, Australia
Email:[EMAIL PROTECTED], Tel: +61 2 9698 2322, Fax: +61 2 9699 9174
"I think it would be a good idea." Ghandi, on Western Civilisation.
--
SLUG - Sydney Linux Users Group Mailing List - http://www.slug.org.au
To unsubscribe send email to [EMAIL PROTECTED] with
unsubscribe in the text
