Subject: ipfwadm?

From: [email-masked]
Date: Wed, 21 Aug 1996 20:14:07 -0400 (EDT)

Anyone here on the Debian-L know the secrets of using the ipfwadm
utility to set up masquerading?  I've built a kernel with the proper
options but I'm concerned about whether I'm really masquerading, or
just forwarding packets.  How do I prove it?  There was a recent LJ
article on using masquerading, but it was primarily based on the 
software prior to the recent advances.  In particular, the method
used to establish the masquerading ruleset, and verifying just what
has been set is my concern.  There is no longer a ipfw, but now the
management utility is ipfwadm.  The concern comes from the setting of
the masquerade rule.

The ipfwadm has an option (-M) for masquerading, but, this is NOT used
for setting the rule, and the only valid option is -l, for listing of
the masquerading rules.  The only way I can get a rule set is to use the
following command (does this really result in masquerading or not is the
question):

#ipfwadm -F -i masquerade -P all -S 192.168.210.0/0 -D 0.0.0.0/0

The reason for the question is this; the ipfwadm -M -l shows no masquerade
rule set.  And, I got on the net using this last nite, and sure enough was
able to get out to the net from my laptop, and using Lynx, got out to the
Web.  I discovered that several links on various pages were not accessible
from the LT, but they were if I ran a browser directly on wb2oyc (my
Deb1.1 box).  This got me wondering if perhaps my reserved net address was
getting thru my ISP to the net, and thats why I wasn't able to get to some
of the links.

So, I ran tcpdump on wb2oyc while doing this.  Sure enough, there I see
packets sent from the Web host directly to the address of the laptop (!)
which is assigned the address in the 192.168 reserved space and shouldn't
ever get thru my ISP's router!  In other words, I was not masquerading for
its address; I don't think.  Bummer!  Worse, my ISP is not stopping those
packets.

Paul

---

From: [email-masked] (Emanuele Pucciarelli)
Date: Thu, 22 Aug 1996 10:21:03 +0200 (OIL DST)

On Wed, 21 Aug 1996 [email-masked] wrote:

> rule set.  

My setup command is more or less like yours, and I can see my masquerade
rule set with 'ipfwadm -Fl', as it is shown with a "msq" type.

/___
/_
/___manuele ([email-masked])

---

From: [email-masked] (Bernd Eckenfels)
Date: Thu, 22 Aug 1996 16:11:13 +0200 (MET DST)

Hi,

# ipfwadm -F -i masquerade -P all -S 192.168.210.0/0 -D 0.0.0.0/0

this is OK.

> The reason for the question is this; the ipfwadm -M -l shows no masquerade

ipfwadm -M -l (or netstat -M) will only show you masqueraded connections,
not the rules. The rules are displayed with "ipfwadm -F -l".

> ever get thru my ISP's router!

I think tcpdump is collecting the already masqueraded packets. You need to
snoop from an other host. Or simply use telnet to loginto any system which
will show you the source you are connecting from.

Greetings
Bernd

---

From: Gerry Jensen <[email-masked]>
Date: Thu, 22 Aug 1996 12:22:25 -0600 (MDT)

On Wed, 21 Aug 1996 [email-masked] wrote:

> just forwarding packets.  How do I prove it?

[stuff deleted]

> its address; I don't think.  Bummer!  Worse, my ISP is not stopping those

I doubt that is really what is happening.  Even if you are sending packets
out onto the Internet from the reserved address (i.e. masquerading not
working), a site on the Internet would have no way of knowing how to route
packets back to the reserved address.  My hunch is that masquerading is
indeed working for you and that you're just misinterpreting the output
from tcpdump. The masquerading is perhaps translating to the reserved
address before you are seeing the output from tcpdump so it looks as if it
is really routing directly to the reserved address which is impossible. 

I've seen the behavior you describe though (that it can only access some
of the sites that the firewall machine can access directly).  Some things
that helped fix things for me were:

* Turn on "IP: always defragment" in the kernel configuration if you
  haven't done so.  
* Make the MTU settings the same on all sections of the link.  If you're
  connected to your ISP via PPP/SLIP, and the laptop is connected via
  ethernet, set the MTU of the PPP/SLIP link to 1500 because that's what
  is the default for ethernet.  (You may be able to lower the MTU of the
  ethernet link to what your PPP/SLIP link is too, but I've always done
  it the other way).

Actually, either of the above tips by themselves may fix the problem as I
think they are essentially doing the same thing.

For what it's worth, this is how I set up masquerading on my machine, but
I know there are several ways to do it.  The way you are doing it sounds
like it is working.

  /sbin/ipfwadm -F -a masquerade -S 192.168.100.0/24 -D 0.0.0.0/0

Good luck,

Gerry
[email-masked]

---

From: [email-masked]
Date: Thu, 22 Aug 1996 21:11:13 -0400 (EDT)

>  /sbin/ipfwadm -F -a masquerade -S 192.168.100.0/24 -D 0.0.0.0/0

Gerry (and all the other respondents too)

Thanks!
You all are saying pretty much the same thing and it sounds like I was
really looking at or misinterpreting what I was seeing from tcpdump.  I
think the idea that I should have been using a 3rd machine to do that 
may be key here.  And Gerry, the command line above is one I had seen in
a previous post either here (maybe it was you then too) or some other 
Linux list and that is what I tried originally, in fact.  However, as 
your line is constructed its saying that masquerade is a "policy" and the
man page for ipfwadm (on Debian 1.1) doesn't mention that being a valid
policy (is the page not current perhaps)?  Anyway, I think, with the help
of the Debian list, that if I don't have it right now, the info you've
provided will help me get it right.

Thanks all!
Paul