Masquerading

The Linux kernel provides an additional mechanism to use in firewall solutions: masquerading of IP packets. This means that some or all packets being forwarded by a Linux system can be changed as if there were sent from the local system. So, the source IP address is replaced by the local IP address and the source port is replaced by a locally generated port (e.g., 60005). Because an administration is kept of masqueraded sessions, incoming packets for that port will automatically be ``demasqueraded'' and forwarded to the system that originally initiated the session.

The next table summarizes the masquerading function, given a telnet session from an internal host (192.168.37.15) to an external host (10.42.17.8), passing a Linux system doing masquerading (192.168.37.1):

Masquerading takes place after passing the forward firewall filter. Demasquerading is done after receiving a packet and demasqueraded packets bypass the forwarding filter. Figure 2 shows the kernel flow diagram including (de)masquerading.

Masquerading is not as easy as it seems: some protocols need special care. One of the problem areas is found in the widely used ftp protocol, because this protocol uses a second session (normally initiated by the remote site) for transferring the actual data. A similar problem arises with some other popular protocols, like IRC and RealAudio. The Linux IP masquerading implementation deals with such protocol-specific features in separately loadable modules. Another problem is that masquerading should operate on transport level connections, whereas it is implemented in the network layer. The current implementation tries to address this with a limited session administration, but there are still some weaknesses to work on.

Masquerading can be enabled by specifying a special option with a forward filter rule. The next command creates a rule that makes every outgoing telnet session being masqueraded (given that our local network has address 192.168.37.0):

   ipfwadm -F -a accept -m -P tcp -S 192.168.37.0/24 \
            1024:65535 -D any/0 telnet

The -m flag in combination with the accept policy means: the packet is accepted (that is, allowed to be forwarded), but it gets masqueraded before being sent out. Because the masquerading mechanism depends on port numbers, it only works for TCP or UDP packets. So, be careful when using commands like:

   ipfwadm -F -a accept -m -S 192.168.37.0/24

This command creates a rule that will cause all outgoing TCP and UDP traffic to be masqueraded. But it will also let all other packets (like ICMP messages) be forwarded unchanged, because they will also match with this rule! So, it's probably better to explicitly handle those cases, like with:

   ipfwadm -F -p deny
    ipfwadm -F -a accept -m -P tcp -S 192.168.37.0/24
    ipfwadm -F -a accept -m -P udp -S 192.168.37.0/24

Especially when using unregistered IP addresses on your internal network (like the addresses defined in RFC1918 or, even worse, illegally used addresses), no packets should ever be forwarded directly.

Please note that there are no ``masquerading rules'', but only forwarding rules with the masquerade flag set. So, you can list the rules with a command like:

   ipfwadm -F -l

which will (given the above example) result in something like:

   IP firewall forward rules, default policy: deny
    type  prot source             destination        ports
    acc/m tcp  192.168.37.0/24    anywhere           any -> any
    acc/m udp  192.168.37.0/24    anywhere           any -> any

Besides this static information, the list of sessions currently being masqueraded can be inspected. This is dynamic information, changing every moment, which can be used to keep track of the external connections being active. The command

   ipfwadm -M -l

might for example produce the following output:

   IP masquerading entries
    prot expire   source           destination      ports
    tcp  13:00.15 int1.foo.com     ext2.bar.com     1017 (60001) -> login
    tcp  14:15.60 int2.foo.com     ext1.bar.com     1346 (60010) -> telnet
    tcp  14:52.82 int1.foo.com     ext1.bar.com     1348 (60015) -> ftp

The above table shows three sessions being masqueraded. The information is read from the pseudo-file /proc/net/ip_masquerade, which is converted to a human-readable format by ipfwadm.