To use the IP masquerade facility, your kernel must be compiled with masquerade support. You must select the following options when configuring a 2.2 series kernel:
Networking options ---> [*] Network firewalls [*] TCP/IP networking [*] IP: firewalling [*] IP: masquerading --- Protocol-specific masquerading support will be built as modules. [*] IP: ipautofw masq support [*] IP: ICMP masquerading |
The 2.4 series kernels no longer offer IP masquerade support as a kernel compile time option. Instead, you should select the network packet filtering option:
Networking options --->
[M] Network packet filtering (replaces ipchains) |
In the 2.2 series kernels, a number of protocol-specific helper modules are created during kernel compilation. Some protocols begin with an outgoing request on one port, and then expect an incoming connection on another. Normally these cannot be masqueraded, as there is no way of associating the second connection with the first without peering inside the protocols themselves. The helper modules do just that; they actually look inside the datagrams and allow masquerading to work for supported protocols that otherwise would be impossible to masquerade. The supported protocols are:
| Module | Protocol |
|---|---|
| ip_masq_ftp | FTP |
| ip_masq_irc | IRC |
| ip_masq_raudio | RealAudio |
| ip_masq_cuseeme | CU-See-Me |
| ip_masq_vdolive | For VDO Live |
| ip_masq_quake | IdSoftware's Quake |
# insmod ip_masq_raudio.o ports=7070,7071,7072 |
The netfilter package includes modules that perform similar functions. For example, to provide connection tracking of FTP sessions, you'd load and use the ip_conntrack_ ftp and ip_nat_ ftp.o modules.
| [1] | RealAudio is a trademark of the Progressive Networks Corporation. |
| [2] | You can contact Ambrose at ambrose@writeme.com. |