March 10, 2007


Filed under: Server Security,Technical Articles — SupportPRO Admin @ 12:07 am



The Internet Protocol (IP) is a data oriented protocol that allows multiple hosts to talk to each other across network connections. Data in an IP network are sent in blocks referred to as packets or datagrams. They typically have a source host, destination host, and source and destination ports associated with the communication. Layered on top of the IP protocol are other protocols. These are typically transport layers. There are two main transport protocols that are heavily used. Transmission control protocol (TCP) is a stateful delivery mechanism that makes a best effort to deliver the packets requested. If the first attempt fails, multiple attempts are made to route and deliver the packet. This protocol is very good at delivering text files that can not tolerate data corruption. With this protocol clients have the ability to request redelivery of packets that were not properly received and can handle our of order delivery of packets. This protocol is very good for applications like patch delivery, email, network file shares, and web pages. It is not very good for delivery of streaming video or voice over IP applications.

Packet Filter


Under Linux, packet filtering is built into the kernel (as a kernel module at the moment), and there are a few trickier things we can do with packets, but the general principle of looking at the headers and deciding the fate of the packet is still there.
Why Would I Want to Packet Filter?


Security : simply dont let anyone connect in, by having the packet filter reject incoming packets used to set up connections.

Watchfulness: Sometimes a badly configured machine on the local network will decide to spew packets to the outside world. Its nice to tell the packet filter to let you know if anything abnormal occurs; maybe you can do something about it, or maybe youre just curious by nature.




Iptables defines five hook points in the kernels packet processing pathways : PREROUTING, INPUT,FORWARD, POSTROUTING and OUTPUT. Built in chains are attached to these hook points you can add a sequence of rules for each hook points each rules represents an oppurtunity to affect or monitor packet flow.

FORWARD that flow through a gateway computer,coming in one interface and going right back out another.

INPUT just before they are delivered to a local process

OUTPUT just after they are generated by a local process

POSTROUTING just before they leave the network interface

PREROUTING just as they arrive from a network interface(after dropping any packets resulting from the interface being in promiscuous mode and after checksum validation.

Options used in Iptables

1. Tables

There are currently three independent tables (which tables are present at any time depends on the kernel configuration options and which modules are present). -t, table table option specifies the packet matching table which the command should operate on. If the kernel is configured with automatic module loading, an attempt will be made to load the appropriate module for that table if it is not already there.

The tables are as follows:

1.1 Filter:


1.2 Nat:


1.3 Mangle:

This table is used for specialized packet alteration.Until kernel 2.4.17 it had two built-in chains: PREROUTING (for altering incoming packets before routing) and OUTPUT (for altering locally-generated packets before routing). Since kernel 2.4.18, three other built-in chains are also supported: INPUT (for packets coming into the box itself), FORWARD (for altering packets being routed through the box), and POSTROUTING (for altering packets as they are about to go out).

2 Chains

By default each table has chains ,which are initially empty,for some or all of the hook points.In addition you can create your own custom chains to organize your rules. A chains policy determines the fate of of packets that reach the end of the chain without otherwise being sent to specific target.only the bulit -in targets ACCEPT and DROP can be used as athe policy for bulit in chain,and the default is ACCEPT.All user-defined chains have an implicit policy of RETURN that cannot be changed.if you want a more complicated policy for a bulit in chain or a policy other than RETURN for a user-defined chain,you can add a rule to the end of the chain that matches all packets,with any targets you like You can set the chains policy to DROP in case you mnake a mistake in youre catch all rule or wish to filter out traffic while you make modifications to youre catch-all rule(by deleting and re-adding with changes)

3. Rules

An iptables rule consists of one or more mach criteria that detrmine which network packets it affects (all match options must be satisfied for the rule to match a packet) and target specification that determines how the network packets will be affected. The system maintains packet and byte counters for every rule.Every time a packet reaches a rule and matches the rule critera,the packet counter is incremented,and the byte counter is increased by the size of the matching packet. Both the match and target portion of the rule are optional.If there are no target specification ,nothing is done to the packets (processing proceeds as if the rule did not existexcept that the packet and byte counters are updated).You can add such a null rule to the FORWARD chain of the filter table with the command: iptables -t filter -A FORWARD

4. Matches

There are variety of matches available for use with iptables,Although some are available only for kernels with certain features enabled. Generic Internet protocol(IP) matches (such as protocol,source or destination address) are applicable to any IP packet In addition to the generic matches ,iptables include many specialised matches available through dynamically loaded extensions (use iptables -m or match option to inform iptables you want to use one these extensions). There is one match extension for dealing with a networking layer below the IP layer.The mac match extension matches based on MAC address.

5. Targets

Targets are used to specify the action to take when a rule matches a packet and also to specify chain policies. Four targets are bulit in to iptables,and extension modules provide others.

ACCEPT : Let the packet through to next stage of processing.stop traversing the current chain,start at the next stage.

DROP : Discontinue processing the packet completeness ,Do not check it against any other rules ,chains,or tables.If you want to provide some feedback to the sender.use the REJECT target extension.

QUEUE : Send packet to userspace (i.e code not in the kernel)

RETURN : From a rule in a user-defined chain,discontinue processing this chain ,and resume traversing the calling chain at the rule following the one that had this chain as its target.from a rule in a built-in chain ,discontinue processing the packet and apply the chains policy to it.

Main Files used in IPTables

* /etc/init.d/iptables- INIT script to start|stop|restart the service (and save rulesets).

* /etc/sysconfig/iptables RedHats file for the iptables-save counter files (i.e. The saved rulesets).

* /sbin/iptables – The administration utility/binary.


# iptables list

Chain INPUT (policy ACCEPT)

target prot opt source destination

Chain FORWARD (policy ACCEPT)

target prot opt source destination

Chain OUTPUT (policy ACCEPT)

target prot opt source destination

This is what you will see when there are no rule sets in place. Looking at this we see 3 Chains.

* INPUT – Holds rules for traffic directed at this server.

* FORWARD Holds rules for traffic that will be forwarding on to an IP behind this server (i.e. If this box serves as a firewall for other servers).

* OUTPUT – Holds rules for traffic that is coming from this server out to the internet.

Mainly we will be dealing with traffic directed at this server, and will be issuing rules for the INPUT Chain. When traffic passes through the kernel, it determines a TARGET based on whether the packet matches a rule or not. General targets are:

* ACCEPT Traffic is accepted for delivery.

* REJECT Traffic is rejected, sending a packet back to the sending host.

* DROP – The traffic is dropped. Nothing is sent back to the sending host.

Configuring Rule Sets

This is the bread-and-butter of packet filtering; manipulating rules. Most commonly, you will probably use the append (-A) and delete (-D) commands. The others (-I for insert and -R for replace) are simple extensions of these concepts.Each rule specifies a set of conditions the packet must meet, and what to do if it meets them (a `target). For example, you might want to drop all ICMP packets coming from the IP address So in this case our conditions are that the protocol must be ICMP and that the source address must be Our target is `DROP. is the `loopback interface, which you will have even if you have no real network connection. You can use the `ping program to generate such packets (it simply sends an ICMP type 8 (echo request) which all cooperative hosts should obligingly respond to with an ICMP type 0 (echo reply) packet). This makes it useful for testing.

# ping -c 1

PING ( 56 data bytes

64 bytes from icmp_seq=0 ttl=64 time=0.2 ms ping statistics

1 packets transmitted, 1 packets received, 0% packet loss



# ping -c 1

PING ( 56 data bytes ping statistics

1 packets transmitted, 0 packets received, 100% packet loss

You can see here that the first ping succeeds (the `-c 1? tells ping to only send a single packet).Then we append (-A) to the `INPUT chain, a rule specifying that for packets from (`-s with protocol ICMP (`-p icmp) we should jump to DROP (`-j DROP).Then we test our rule, using the second ping. There will be a pause before the program gives up waiting for a response that will never come.


# iptables -D INPUT 1

To delete rule number 1 in the INPUT chain.

The second way is to mirror the -A command, but replacing the -A with -D. This is useful when you have a complex chain of rules and you dont want to have to count them to figure out that its rule 37 that you want to get rid of. In this case, we would use:



Filtering Specifications

We have seen the use of `-p to specify protocol, and `-s to specify source address, but there are other options we can use to specify packet characteristics. What follows is an exhaustive compendium.

Specifying Source and Destination IP Addresses

Source (`-s, `source or `src) and destination (`-d, `destination or `dst) IP addresses can be specified in four ways. The most common way is to use the full name, such as `localhost or ` The second way is to specify the IP address such as `

The third and fourth ways allow specification of a group of IP addresses, such as ` or ` These both specify any IP address from to inclusive; the digits after the `/ tell which parts of the IP address are significant. `/32? or `/ is the default (match all of the IP address). To specify any IP address at all `/0? can be used, like so:

[ NOTE: `-s 0/0? is redundant here. ]


This is rarely used, as the effect above is the same as not specifying the `-s option at all.

Specifying Inversion

Many flags, including the `-s (or `source) and `-d (`destination) flags can have their arguments preceded by `! (pronounced `not) to match addresses NOT equal to the ones given. For example. `-s ! localhost matches any packet not coming from localhost.

Specifying Protocol

The protocol can be specified with the `-p (or `protocol) flag. Protocol can be a number (if you know the numeric protocol values for IP) or a name for the special cases of `TCP, `UDP or `ICMP. Case doesnt matter, so `tcp works as well as `TCP.

The protocol name can be prefixed by a `!, to invert it, such as `-p ! TCP to specify packets which are not TCP.

Specifying an Interface

The `-i (or `in-interface) and `-o (or `out-interface) options specify the name of an interface to match. An interface is the physical device the packet came in on (`-i) or is going out on (`-o). You can use the ifconfig command to list the interfaces which are `up (i.e., working at the moment).

Packets traversing the INPUT chain dont have an output interface, so any rule using `-o in this chain will never match. Similarly, packets traversing the OUTPUT chain dont have an input interface, so any rule using `-i in this chain will never match.



As a special case, an interface name ending with a `+ will match all interfaces (whether they currently exist or not) which begin with that string. For example, to specify a rule which matches all PPP interfaces, the -i ppp+ option would be used.

The interface name can be preceded by a `! with spaces around it, to match a packet which does not match the specified interface(s), eg -i ! ppp+.

Specifying Fragments





Otherwise, it is important to understand how fragments get treated by the filtering rules. Any filtering rule that asks for information we dont have will not match. This means that the first fragment is treated like any other packet. Second and further fragments wont be. Thus a rule -p TCP sport www (specifying a source port of `www) will never match a fragment (other than the first fragment). Neither will the opposite rule -p TCP sport ! www.

However, you can specify a rule specifically for second and further fragments, using the `-f (or `fragment) flag. It is also legal to specify that a rule does not apply to second and further fragments, by preceding the `-f with ` ! .




# iptables -A OUTPUT -f -d -j DROP

Extensions to iptables: New Matches





Extensions come in two types: new targets, and new matches (well talk about new targets a little later). Some protocols automatically offer new tests: currently these are TCP, UDP and ICMP as shown below.

For these you will be able to specify the new tests on the command line after the `-p option, which will load the extension. For explicit new tests, use the `-m option to load the extension, after which the extended options will be available.

To get help on an extension, use the option to load it (`-p, `-j or `-m) followed by `-h or `help, eg:

# iptables -p tcp help

TCP Extensions

The TCP extensions are automatically loaded if `-p tcp is specified. It provides the following options (none of which match fragments).



# iptables -A INPUT protocol tcp tcp-flags ALL SYN,ACK -j DROP

This indicates that all flags should be examined (`ALL is synonymous with `SYN,ACK,FIN,RST,URG,PSH), but only SYN and ACK should be set. There is also an argument `NONE meaning no flags.


Optionally preceded by a `!, this is shorthand for `tcp-flags SYN,RST,ACK SYN.


followed by an optional `!, then either a single TCP port, or a range of ports. Ports can be port names, as listed in /etc/services, or numeric. Ranges are either two port names separated by a `:, or (to specify greater than or equal to a given port) a port with a `: appended, or (to specify less than or equal to a given port), a port preceded by a `:.


is synonymous with `source-port.







An Explanation of TCP Flags



The solution is to block only the packets used to request a connection. These packets are called SYN packets (ok, technically theyre packets with the SYN flag set, and the RST and ACK flags cleared, but we call them SYN packets for short). By disallowing only these packets, we can stop attempted connections in their tracks.


-p TCP -s syn

This flag can be inverted by preceding it with a `!, which means every packet other than the connection initiation.

UDP Extensions

These extensions are automatically loaded if `-p udp is specified. It provides the options `source-port, `sport, `destination-port and `dport as detailed for TCP above.

ICMP Extensions

This extension is automatically loaded if `-p icmp is specified. It provides only one new option:


followed by an optional `!, then either an icmp type name (eg `host-unreachable), or a numeric type (eg. `3?), or a numeric type and code separated by a `/ (eg. `3/3?). A list of available icmp type names is given using `-p icmp help.

Other Match Extensions



This module must be explicitly specified with `-m mac or `match mac. It is used for matching incoming packets source Ethernet (MAC) address, and thus only useful for packets traversing the PREROUTING and INPUT chains. It provides only one option:


followed by an optional `!, then an ethernet address in colon-separated hexbyte notation, eg `mac-source 00:60:08:91:CC:B7?.


This module must be explicitly specified with `-m limit or `match limit. It is used to restrict the rate of matches, such as for suppressing log messages. It will only match a given number of times per second (by default 3 matches per hour, with a burst of 5). It takes two optional arguments:


followed by a number; specifies the maximum average number of matches to allow per second. The number can specify units explicitly, using `/second, `/minute, `/hour or `/day, or parts of them (so `5/second is the same as `5/s).



This match can often be used with the LOG target to do rate-limited logging. To understand how it works, lets look at the following rule, which logs packets with the default limit parameters:

# iptables -A FORWARD -m limit -j LOG




Syn-flood protection:

# iptables -A FORWARD -p tcp syn -m limit limit 1/s -j ACCEPT

Furtive port scanner:

# iptables -A FORWARD -p tcp tcp-flags SYN,ACK,FIN,RST RST -m limit limit 1/s -j ACCEPT

Ping of death:

# iptables -A FORWARD -p icmp icmp-type echo-request -m limit limit 1/s -j ACCEPT

This module works like a hysteresis door, as shown in the graph below.

rate (pkt/s)

^ ..

| / DoS \

| / \

Edge of DoS -|..:\..

= (limit * | /: \

limit-burst) | / : \ .-.

| / : \ / \

| / : \ / \

End of DoS -|/.:..:/.\./.

= limit | : :`- `

-+++> time (s)

LOGIC => Match | Didnt Match | Match


<Flood 1> <Flood 2>

Total ^ Line __ YNNN

Packets| Rate __ YNNN

| mum __ YNNN

10 | Maxi __ Y

| __ Y

| __ Y

| __ YNNN


5 | Y

| Y Key: Y -> Matched Rule

| Y N -> Didnt Match Rule

| Y


0 +> Time (seconds)





uid-owner userid


gid-owner groupid


pid-owner processid


sid-owner sessionid



This experimental module must be explicitly specified with `-m unclean or `match unclean. It does various random sanity checks on packets. This module has not been audited, and should not be used as a security device (it probably makes things worse, since it may well have bugs itself). It provides no options.

The State Match

The most useful match criterion is supplied by the `state extension, which interprets the connection-tracking analysis of the `ip_conntrack module. This is highly recommended.

Specifying `-m state allows an additional `state option, which is a comma-separated list of states to match (the `! flag indicates not to match those states). These states are:


A packet which creates a new connection.






A packet which could not be identified for some reason: this includes running out of memory and ICMP errors which dont correspond to any known connection. Generally these packets should be dropped.

An example of this powerful match extension would be:

# iptables -A FORWARD -i ppp0 -m state ! state NEW -j DROP

Target Specifications


There are two very simple built-in targets: DROP and ACCEPT. Weve already met them. If a rule matches a packet and its target is one of these two, no further rules are consulted: the packets fate has been decided.


User-defined chains

One powerful feature which iptables inherits from ipchains is the ability for the user to create new chains, in addition to the three built-in ones (INPUT, FORWARD and OUTPUT). By convention, user-defined chains are lower-case to distinguish them (well describe how to create new user-defined chains below in Operations on an Entire Chain).

When a packet matches a rule whose target is a user-defined chain, the packet begins traversing the rules in that user-defined chain. If that chain doesnt decide the fate of the packet, then once traversal on that chain has finished, traversal resumes on the next rule in the current chain.


`INPUT `test

– –


|| ||


|| –

| Rule3: -p UDP -j DROP |

Consider a TCP packet coming from, going to It enters the INPUT chain, and gets tested against Rule1 – no match. Rule2 matches, and its target is test, so the next rule examined is the start of test. Rule1 in test matches, but doesnt specify a target, so the next rule is examined, Rule2. This doesnt match, so we have reached the end of the chain. We return to the INPUT chain, where we had just examined Rule2, so we now examine Rule3, which doesnt match either.

So the packet path is:

v __________________________

`INPUT | / `test v

|/ |-

| Rule1 | /| | Rule1 | |

||/-| |-||

| Rule2 / | | Rule2 | |

|| v-

| Rule3 /+___________________________/



User-defined chains can jump to other user-defined chains (but dont make loops: your packets will be dropped if theyre found to be in a loop).

Extensions to iptables: New Targets





Followed by a level number or name. Valid names are (case-insensitive) `debug, `info, `notice, `warning, `err, `crit, `alert and `emerg, corresponding to numbers 7 through 0. See the man page for syslog.conf for an explanation of these levels. The default is `warning.



This module is most useful after a limit match, so you dont flood your logs.


This module has the same effect as `DROP, except that the sender is sent an ICMP `port unreachable error message. Note that the ICMP error message is not sent if (see RFC 1122):


* The packet being filtered was a non-head fragment.


REJECT also takes a `reject-with optional argument which alters the reply packet used: see the manual page.

Special Built-In Targets




* a queue handler, which deals with the actual mechanics of passing packets between the kernel and userspace; and

* a userspace application to receive, possibly manipulate, and issue verdicts on packets.



# modprobe iptable_filter

# modprobe ip_queue

# iptables -A OUTPUT -p icmp -j QUEUE



The status of ip_queue may be checked via:





Operations on an Entire Chain


Creating a New Chain

Lets create a new chain. Because I am such an imaginative fellow, Ill call it test. We use the `-N or `new-chain options:

# iptables -N test

Its that simple. Now you can put rules in it as detailed above.

Deleting a Chain

Deleting a chain is simple as well, using the `-X or `delete-chain options. Why `-X? Well, all the good letters were taken.

# iptables -X test

There are a couple of restrictions to deleting chains: they must be empty (see Flushing a Chain below) and they must not be the target of any rule. You cant delete any of the three built-in chains.

If you dont specify a chain, then all user-defined chains will be deleted, if possible.

Flushing a Chain

There is a simple way of emptying all rules out of a chain, using the `-F (or `flush) commands.

# iptables -F FORWARD

If you dont specify a chain, then all chains will be flushed.

Listing a Chain

You can list all the rules in a chain by using the `-L (or `list) command.



There are three options which can accompany `-L. The `-n (numeric) option is very useful as it prevents iptables from trying to lookup the IP addresses, which (if you are using DNS like most people) will cause large delays if your DNS is not set up properly, or you have filtered out DNS requests. It also causes TCP and UDP ports to be printed out as numbers rather than names.


Note that the packet and byte counters are printed out using the suffixes `K, `M or `G for 1000, 1,000,000 and 1,000,000,000 respectively. Using the `-x (expand numbers) flag as well prints the full numbers, no matter how large they are.

Resetting (Zeroing) Counters

It is useful to be able to reset the counters. This can be done with the `-Z (or `zero) option.

Consider the following:

# iptables -L FORWARD

# iptables -Z FORWARD

In the above example, some packets could pass through between the `-L and `-Z commands. For this reason, you can use the `-L and `-Z together, to reset the counters while reading them.

Other Configuration files


It contains settings for configeration in the /proc/sys directory that are applied at boot time,For example /proc/sys/net/ipv4/ip_forward can be set to 1 at boot time by adding an entry net.ipv4.ip_forward=1 to this file


Dumps the contents of connection tracking structures if you read it.


controls the size of the connection tracking table in the kernel.The default value is calculated based on the amount of the RAM in your computer.You may need to increase it if you are

getting ip_contrack:table full,dropping packet errors in youre log files ,see also the entry for /etc/sysctl.conf in this table


You need to set this to 1 for the host to act as a gateway (forwarding packets among the networks connected to its interfaces).see also the entry for /etc/sysctl.conf

7.0 Compile your own kernel

On the RedHat mechines you can determine the Kernel you are currently running by looking at the output of the uname -r command which will print the a message such as this 2.4-20-20-9

Using your kernel version and your mechine type which can be determined by consulting the output of uname -a.

You can find the most appropriate configeration file to use to bulid your new kernel in a file named something like this /usr/src/linux version/configs/kernel-2.4-20-i686.config

The following configeration option must be selected at a minimum

1. CONFIG_PACKET (direct communication with network interfaces)

2. CONFIG_NETFILTER (the basic kernel support required by the iptables)

3. CONFIG_IP_NF_CONTRACK (required for NAT and Masqurading)

4. CONFIG_IP_NF_FILTER (adds the filter table)

5. CONFIG_IP_NF_IPTABLES (the basic support for user space iptables utility)

6. CONFIG_IP_NF_MANGLE (adds the mangle table)

7. CONFIG_IP_NF_NAT (adds the nat table)

The iptables configeration settings are found in entries with names like CONFIG_IP_NF_*.

8.0 Connect Tracking

Iptables associate packets with the logical connections they belong to (even considers certain UDP communications patterns to imply connections even though UDP is cvonnection less protocol).Inorder to do this it tracks the progress of connections through their lifecycle and this tracking information is made available through the conntrack match extension

although the underlying TCP connection state model is more complicated,the connection tracking logic assigns one of the states in the table to each connection at any point in time

Connection tacking states

ESTABLISHED:The connection has already seen packets going in both directions.

INVALID: The packet doesnt belong to any tracked connections

NEW:The packet is starting a new connection or is part of a connection that hasnt yet seen in both directions

RELATED:The packet is starting a new connection,but the new connection is related to an existing connection.

The connection tracking logic maintains three bits of status information associated with each connection below table contains a list of these status coded as they are named in the conntrack match extension.

ASSURED: For TCP connections indicates the TCP connections set up has been completed

For UDP connections indicates it look like UDP stream to the kernel

EXPECTED: Indicates the connection was expired

SEEN_REPLY The iptables connection tracking logic allows plug in modules to help identify new connections that are related to existing connections.You need to use these plug-ins.if you want to make multi connection protocols work right across your gateway/firewall below tables give the main connection tracking helpermodules To use these you need to run the mod probe command to install the kernel module

Helper match modules

ip_contrack_amanda Amanda backup protocol(requires CONFIG_IP_NF_AMANDA kernel config)

ip_contrack_ftp File Transfer protocol(requires CONFIG_IP_NF_FTP kernel config)

ip_contrack_tfirc Internet relay chat (requires CONFIG_IP_NF_IRC kernel config)

ip_contrack_tftp Trivial File transfer protocol(requires CONFIG_IP_NF_TFPT kernel config


The kernel automatically tracks packet and byte counts for each rule.This information can be used to do accounting on network usage.

For example ,if you add the following four rules to a mechine serving as an internet gateway(assuming two network interfaces :eth0 for the internel network and eth1 for the internet connection),kernel tracks the number of packets and bytes exchanged with the outside world.

iptables -A FORWARD -i eth1

iptables -A FORWARD -i eth1

iptables -A INPUT -i eth1

iptables -A OUTPUT -i eth1

After running these commands iptables -L -v shows (note the counts for INPUT and OUTPUT:

the nonzero counts indicate that some traffic had already traversed the cjhains by the time we displayed the counts.


Basic NAT is the process of translating, or mapping, one set of IP addresses (usually private) to another (usually public). It was originally developed to keep private addresses from being seen on public networks. It so happens that the largest public network, the Internet, virtually assured that NAT would be around for a long time to come.

Think of NAT as acting like a postal interpreter. It waits for a message to be started from someone it knows. It then translates the conversation to come from a different address (usually itself), then sends the message on its way. As the message reply comes back, NAT remembers the conversation, and applies the destination address of the person it knows, sending it back inside to that person. It can remember and process multiple messages at once. In real use, NAT translates all types of IP based traffic between two different address ranges.

There are many reasons why NAT is used. Some of those include the dwindling amount of IPv4 Internet addresses, corporate network security, mis-used IP addresses on corporate networks, and finally, cost savings on Internet connectivity. It is not my intention to explain all of these, nor is it my intention to give a dissertation on the subject. Rather, I will give a breakdown of how NAT works, and when you will most likely use it.

How does NAT work?

In its simplest form, NAT will translate a range of addresses to another range of addresses. Usually one range is inside a corporate network, and uses the private range approved for that application. Private address ranges are not normally routable over the internet and are usually filtered from ever leaving an internet border router. These ranges include:

10.X.X.X with any mask or greater. 172.16.X.X through 172.31.X.X with any mask or greater. 192.168.X.X with any mask or greater.

Notice that these ranges include all three traditional classes of addresses, A, B, and C. Also note that you do not have to use them by their normal classes as long as your network equipment, and routing protocols will support that.

What do I mean by a greater mask? Lets take the case of 10.X.X.X. Thats Microsofts default network on most NT setups. There is absolutely no need to use the standard class A mask for that network. Doing so would limit you to one network number, in this case 10, but allow you to have over 16.5 million hosts. Thats a little large for most networks. Instead, its much more common to have something like 10.0.0.X ( at your home office, and maybe 10.0.1.X ( at your remote office. By doing this, you have plenty of room for future networks, with 254 useable host entries per network. So my explanation of a greater mask would be anything greater than the value I listed. For more information on IP addressing, see the IP addressing and Subnets article.

Splitting up the addresses without heed to class is known as classless addressing. It is quite common and most modern networking equipment and OSs will support it.

So, NAT takes care of the translation from private addresses, to public addresses in order for the traffic to be routable on the internet. As the information comes back, the original request is re-mapped to the table held by the router, and information is passed inside to the original machine that requested it. NAT can translate any two address ranges back and forth, but from Private to Public is the most common.

Source NAT and Masqurading

IP masquerading is a form of network address translation (NAT) which allows internal computers with no known address outside their network, to communicate to the outside. It allows one machine to act on behalf of other machines. It is similar to someone buying stocks through a broker (without considering the monetary transaction). The person buying stocks, tells the broker to buy the stocks, the broker gets the stocks and passes them to the person who made the purchase. The broker acts on behalf of the stock purchaser as though he was the one buying the stock. No one who sold the stock knew or cared about whether the broker was buying for himself or someone else.

Please DO NOT confuse routers with firewalls and the performance of IP masquerading. The commands that allow IP masquerading are a simple form of a firewall, however routing is a completely different function, as described previously. Setting a computer up to act as a router is completely different than setting up a computer to act as a firewall. Although the two functions are similar in that the router or firewall will act as a communication mechanism between two networks or subnets, the similarity ends there. A computer can be either a router or a firewall, but not both. If you set up a computer to act as both a router and a firewall, you have defeated the purpose of your firewall!

NAT is classified in to into two different types: Source NAT Destination NAT



Article Authored by Anoopkiran

Author, Anoopkiran, is a Sr.Systems Engineer with SupportPRO. Anoopkiran specializes in Linux servers Administration. SupportPRO offers 24X7 technical support services to Web hosting companies and service providers.

AddThis Social Bookmark Button

No Comments »

No comments yet.

RSS feed for comments on this post. TrackBack URL

Leave a comment

You must be logged in to post a comment.

Powered by WordPress