RuggedRouter User Guide
Note that a client on the Internet that is probing the RuggedRouter's TCP/UDP ports
will receive no responses and will not be able to detect the presence of the router. A
host in the local network, on the other hand, will fail to connect to the router but will
receive a notification.
Note that order of policies is important. If the last rule of this example were entered
first then no connections at all would be allowed.
Policies are defined in the file /etc/shorewall/policy and are modified from the
Default Policy menu.
Masquera ding And SN AT
Masquerading and Source NAT (SNAT) are forms of dynamic NAT.
Masquerading substitutes a single IP address for an entire internal network. Use
masquerading when your ISP assigns you an IP address dynamically at connection
time.
SNAT substitutes a single address or range of addresses that you been assigned by
your ISP. Use SNAT when your ISP assigns you one or more static IP addresses that
you wish to one or more internal hosts.
The masquerading/SNAT entries are defined in the file /etc/shorewall/masq and are
modified from the Masquerading menu. Each entry is of the form:
Interface Subnet Address Protocol Port(s)
Interface is the outgoing (WAN or Ethernet) interface and is usually your Internet
interface.
Subnet is the subnet that you wish to hide. It can be an interface name (such as eth1)
or an subnetted IP address.
Address is an (optional IP) address that you wish to masquerade as.
Note: T he presenc e of the Address fi eld determ ines whet her masque rading or SNAT is being us ed. Masqu erading is used whe n only Int erface an d Subnet a re present . SNAT
is used when Inte rface, Su bnet and A ddress ar e present .
Protocol (optionally) takes on the name of protocols (e.g. tcp, udp..) that you wish to
masquerade.
Ports (optionally) takes on the ports to masquerade when protocol is set to tcp or udp.
These can be raw port numbers or names as found in file /etc/services.
Some examples should illustrate the use of masquerading:
RuleInterface Subnet Address Protocol Ports
1 eth1 eth2
2 ppp+ eth2 66.11.180.161
3 ppp+ 192.168.0.0/24 66.11.180.161
4 w1ppp eth1 100.1.101.16
5 w1ppp eth1 100.1.101.16 tcp smtp
1) In this masquerading rule, port eth2 is connected to the local network an d eth1 is
connected to a DSL modem. Traffic from the subnet handled by eth2 should be
translated to whatever IP is assigned to the modem. Internet clients will not be
able to determine the router's public address unless some form of dynamic dns is
employed.
108 RuggedCom