Link Exchange Fast Counter

IP Masq Step-by-Step

This page is a set of terse instructions for setting up IP masquerading. It's not very complete but will get you up and running in no time.

What You Need

I am using Redhat 6.0, so these instructions are heavily geared towards that setup:

A stock Redhat 6.0 kernel will have everything you need compiled in, if you compile the kernel yourself then you need all the firewall and masquerading options enabled.

The Commands

Let's assume that your internal network IP addresses are 192.168.0.x, add these commands to your /etc/rc.d/rc.local:

export PATH=$PATH:/sbin

# Load masquerading modules
modprobe ip_masq_ftp
modprobe ip_masq_irc
modprobe ip_masq_raudio
modprobe ip_masq_quake
modprobe ip_masq_user

# Build IP chain rules
ipchains -F
ipchains -P forward DENY
ipchains -A forward -j MASQ -s 192.168.0.0/24

That's it!

How It Works

It's magic, here is a pretty diagram, I will explain later on :)

Computers B, C, and D are completely unaware that they don't have "real" IP addresses. As far as they are concerned, they are connected directly to the Internet. When they request something from the Internet:

  1. they send outgoing "request" packets out
  2. computer A rewrites these packets, keeping track of who sent what, then forwards the packets onto the Internet
  3. incoming "response" packets come back to computer A
  4. computer A magically figures out which one of B, C, or D to relay that packet to

Yes, that is an extreme over simplification of what happens, but it is all you need to know for now. Some services (like FTP, IRC, etc.) need special treatment, and that is why we load special modules (ip_masq_ftp, ip_masq_irc, etc.) to handle them.

Tell Me More

Here are some resources that will give you more information:

Can Windows Do This

Yes, if you really can't find an old 486 to run Linux, take a look at these packages: