Baslinux mailing list

[baslinux AT lists.ibiblio.org]

> > ipchains -A forward -i eth0 -j MASQ

Last time around I think we were using -s 192.168.1.0/24 instead, so I 
have done some reading to try to understand the difference (see below).

> Thank, you, Steven. It obviously was the ethN parameter that
> was missing. Now the gateway is working. I probably can even log
> in with DOS from the client machine.
>
> Here is the summary:

I am trying to understand your setup:

eth0  Onboard (PCI) ethernet controller (eth0).

eth1

pcmcia wireless card, communicating with wireless router on another floor. 
Can you assign eth1 IP number with ifconfig instead, if you know its range 
of IP numbers and how many other computers are communicating with it?


> ------ GW-UP -------------
> #!/bin/sh
> # load drivers eth0 = LAN ethernet PCI, eth1 = wireless PCMCIA
> insmod eepro100
> /etc/pcmcia/start
> # connect to internet router
> udhcpc -i eth1
> # connect to LAN
> ifconfig eth0 192.168.1.1
> # enable forwarding
> ipchains -P forward DENY
> ipchains -A forward -i eth1 -j MASQ
> echo 1 > /proc/sys/net/ipv4/ip_forward
> ---------------------------

Connect your desktop via cable to the laptop gateway, then pass signals 
back and forth between it and the wireless router over the wireless 
router.

> ------ LAN-UP -------------
> #!/bin/sh
> # load driver eth0 = LAN ethernet PCMCIA
> /etc/pcmcia/start
> # connect to LAN
> ifconfig eth0 192.168.1.2
> # establish up gateway to share internet connection
> route add default gw 192.168.1.1
> ---------------------------
>
> Christof

I found some tutorials on IPCHAINS.
http://www.tldp.org/HOWTO/IPCHAINS-HOWTO.html  (2000)
http://www.syrlug.org/contrib/ipchains.html (tutorial)
http://www.linuxplanet.com/linuxplanet/tutorials/2100/3

All about firewalls, routing, port forwarding, masquing. Ipchains ns is a 
rewrite of IPv4 and ipfwadm which started in linux 2.1, and is more 
powerful and easier to set up.

The HOWTO also explain packets filtering (whether to accept or deny or 
reject packets based on the header).  You can set your filter to not 
accept packets with headers from certain IP addresses that you know only 
send ads.  (That may be how registered copies of Arachne eliminated banner 
ads).  You can prevent other people from telnetting to your network.

If your kernel has ipchains you will see a /proc/net/ip_fwchains (I also 
have ip_fwname and ip_masquerade).

To configure a 2.2 kernel for ipchains
CONFIG_FIREWALL=Y
CONFIG_IP_FIREWALL=Y
(It was different for 2.4, which by default uses some other method now).

Then ipchains communicates with the kernel to filter packets.

There are ways to make the setup permanent.

Besides packet filtering, ipchains controls masquerading 
The tldp example uses not
ipchains -A forward -s 192.168.1.0/24 -j MASQ
but
ipchains -A forward -i ppp0 -j MASQ

The masquerade howto link at tldp is broken, use:

http://linuxselfhelp.com/HOWTO/IP-Masquerade-HOWTO/index.html

The -s part lets internal interfaces MASQ out to the Internet (via a 
router, which the tldp example did not use), whereas the -i part is for 
communication inside your local network (which I did not have except for 
between client and gateway) and Steven's setup omits it.

IP Masquerade is the linux function similar to a firewall or network 
router.  It works via PPP or ethernet etc and lets computers on an 
internal LAN connected to a gateway (which has internet connection) use 
this connection even though they don't have IP addresses on the external 
network (that of the router to which the gateway is connected, or the ISP 
assigned IP address when you dial in).  It also adds security.

You can use browsers, telnet, ssh, ping, traceroute over this setup.
For ftp, irc, and realaudio you need extra IP MASQ modules.  (I did not 
try these).  Streaming MP3 should work.

You should be able to use it to connect linux and DOS-based systems with 
packet drivers and NCSA Telnet package.

The MASQ server apparently edits packet headers, changing the IP addresses 
between that of the gateway and the local computer(s), so that local 
computers act as if they are on the external network which is connected to 
the internet via router or modem.

Kernel 2.0 used IPFWADM, 2.2 used IPCHAINS, and 2.4 usually uses IPTABLES 
but I compiled with IPCHAINS so I could use Steven's setup.  IPTABLES is 
better but is more complicated.

I read the 2.2 HOWTO section (IPCHAINS).

Slackware 2.2 kernels should have ipchains function built in.  Check the
config files for the above two lines with Y.

Setting up IP Masquerade has info on compiling kernels.

192.169.0.1 is recommended for the gateway IP number (but if you are using 
a router it has its own default IP number).
(Steven, please correct me here).

The example here is for two client machines 192.168.0.2 and .8

ipchains -P forward DENY
ipchains -A forward -i $EXTIF -s 192.168.0.2/32 -j MASQ
ipchains -A forward -i $EXTIF -s 192.168.0.8/32 -j MASQ

The /32 is a 32-bit subnet mask (with a 32-bit routing prefix) and we have 
24-bit (wikipedia).  255.255.255.0 is the subnet mask for the 192.168.1.0 
network with 24-bit routing prefix (192.168.1.0/24).  (???).

I don't understand much of this beyond the fact that information packets 
are being sent to and from the gateway from computers with IP numbers 
listed on the forward lines, and the gateway changes the IP numbers of the 
packet headers to match those of the external network (that the router is 
on, or the assigned IP numbers when you dial the ISP).


Chapter 4.5 discusses configuring DOS.
http://www.linuxselfhelp.com/HOWTO/IP-Masquerade-HOWTO/x1188.htm


A site for beginners:

http://www.geekcomix.com/cgi-bin/classnotes/wiki.pl?UNIX03/IPChains_Commands

The two most commonly used features of ipchains:
ipchains -P chain target [options]
ipchains -A chain rule [options]
(Forget about -ADC -RI -D -LFZNX and -M -L -S -h)

Target - default policy, can be ACCEPT, DENY, REJECT, MASQ, REDIRECT or 
RETURN.  In our case, default is to DENY.

ipchains -P forward DENY
default is to deny a packet if it does not meet the rules to be forwarded 
to the local network (client computer)


ipchains -A forward XXXXX -j MASQ
adds rules to a given chain.

In our case I think -s 192.168.0.1/24 (anything on our LAN) is masqueraded, 
meaning packet headers are rewritten by the gateway to make it look like 
clients are part of the external network.

You can probably add more stuff to block packets from certain IP numbers.

Steven, please correct any misinformation above.