Ask Slashdot: IP Masquerading Drawbacks? 212
A Nameless Slashdotter submitted this question:
"IP Masquerading (NAT under FreeBSD) is straight from the Gods. Yet it has a few very large drawbacks, such as inability to do DCC or ICQ file transfers, or play games over the internet on one of the Masq'ed machines, even with the "irc" and "quake" masquerading modules loaded. Someone give me options to solve this problem, be it another operating system, a firewall setting, a program or setup!"
Socks5 Proxy Server (Score:1)
IPMasq HOWTO (Score:1)
Re:Use Win98 Second Edition (j/k) (Score:1)
-Sol
How I did it (Score:1)
Assuming that you have the basic machine working and it works as a gateway for WWW based applications, the next thing is getting the IP MASQ modules loaded.
All the how-tos and do it yourself pages have not seemed to keep up with the various versions of software as well as the move to IPChains, which is a real pain in the a**.
With RH6 I could not get it to work until I did the following (note: no kernel recompilation):
in
echo 1 >
ipchains -P forward DENY
ipchains -A forward -i eth1 -j MASQ
insmod ip_masq_ftp
insmod ip_masq_raudio
insmod ip_masq_irc
insmod ip_masq_icq
insmod ip_masq_quake
This took care of all the general use items. I have not had a single problem with FTP, IRC or ICQ yet).
The ip_masq_icq module is not in the standard distribution of RH6, so you need to grab it from the following page:
ip_masq_icq http://members.tripod.com/~djsf/masq-icq/ [tripod.com]
For games, there are going to be major problems trying to run more than a single client from behind the gateway machine. To get around this I simply signed up 2 accounts with Kali and grabbed the Linux version of their proxy (binary only) from here:
kProxy http://www.kali.net/js/software/kproxy. html [kali.net]
As a side benefit, it is a Socks5 proxy, so anything that supports it can be run through kproxy.
Do *not* try to autostart the kproxy from you module scripts. I created a user just to run kproxy and login and start the proxy manually.
This may or may not work for you system, but it took me a whole weekend to get it running so if it works, maybe you'll have saved a little time.
--
P.S. If anyone can tell me how I could autostart kproxy in another terminal automatically, let me know. My gateway machine does not even have X installed, so no KDE,Gnome solutions please.
Straight from the gods? Maybe the fallen one. (Score:2)
Though some people will strongly disagree, I've always preferred firewall-traversal approaches such as SOCKS. Under Linux -- and possibly *BSD -- there are shared library tricks you can pull that will automagically add SOCKS support to most applications. Under Windows, some Winsock DLLs (the Trumpet one, I think) have SOCKS proxy support. What SOCKS does is effectively an RPC to the firewall, so that the application knows what addressing information is being used and can generate the right application-layer communications to talk with the other side without things breaking.
Re:Nothing wrong with it. (Score:2)
As with all hacks, you eventually have to figure out what makes it so good, figure out what it needs, and then rewrite it into a clean piece of code.
What makes IPMasquing good is that it effectively sends and retrieves from the internet at the users request. It does it at a very low level, and in the kernel, so it is very fast.
What IPMasquing needs is the ability to allow users to connect to sockets on computers behind the firewall. This can be done, as you said, by having applications tell the masquing box that they need information forwarded. However when you do this, what you effectively have is a SOCKS server.
So maybe the answer lies in implementing socks-like functionality in the Linux kernel. There are probably reasons why this isn't a good idea, but I think you'll agree that the current technique (writing kernel modules for _EVERY_ program which needs bidirectional firewall traversal) needs to be replaced.
This is it -- the perfect example... (Score:2)
Yet you insult the poster for no decernable purpose, and add nothing to the discussion. It's the damn elietism that turns people off. People arn't going to embrace linux if you're being a dick about it. You don't have to help them, but there's no reason to harass them (and many a reason not to).
Ugh.
Games, Games, Games (Score:1)
Those that don't need to get their act together.
Things that I have played just fine recently (read, I at least see their CDs lieing around my desk, more work but I can't think of em all right now): Half-Life, Quake 3, Myth 1 and 2, Tribes, F22 Lightnine 3 Demo, even 2am.com's group of free games. I did pop in my old SWAT 2 and that one didn't work. Some game companies at least have a tech support FAQ that may tell what ports to redirect or anything to help. I say we start petitioning companies that refuse to make Linux ports to at least make compatible multiplayer gaming...
Re:ftp connections break (Score:1)
YAQ: streaming video through masq (Score:1)
Maybe anyone has an idea how to get this to work properly?
Re:How to do DCC (Score:1)
[tripod.com]
http://members.tripod.com/~djsf/masq-icq/
IF someone has tried it, can you send me a message with how well it works and any advice. Remove the nospam from my e-mail and you've got it.
LBS
Re:Use Win98 Second Edition (j/k) (Score:2)
Use a SOCKS5 firewall/proxy (Score:2)
Re:Use Win98 Second Edition (j/k) (Score:2)
Re:No problems for me. (Score:2)
-E
I bet you use Red Hat 6.0 (Score:4)
Solution: Create
Distributions which manually specify modules to be loaded, like Debian or (maybe) Caldera, don't have this problem. It's just distributions which try to get fancy by using the kernel-level module auto-loader that have this problem (and only under the 2.2 kernel, which removed the 2.0 kernel's timeout functionality for the auto-loader).
With the proxy modules loaded, I've never had any problems with reverse connections on FTP, Quake, etc. That's why I'm suspecting either a) you don't have them loaded, or b) Red Hat 6.0 (or Mandrake 6.0) is helpfully unloading them for you!
-E
ident? (Score:1)
Thanks.
Re:I would think that a 386 would give noticable (Score:1)
It does work... more or less... most of the outside world 0DNS queries time-out because of the lag.. oh well, works better with the internal DN queries so I'm not to bothered :)
---
Linux Router Project is the way to go. (Score:1)
Unless you want a really spiffy brand new kernel on your router (doesn't bother me) the Linux Router Project [linuxrouter.org] disk is a damn fine way to go.
I have mine set up on an old 486 in a pizzabox case and it works beautifully. All I did was tweak a few IP numbers, tell it to do transparent proxying and I haven't noticed any difference from being dialled up directly, apart from my flatmates sucking all the bandwidth that is :).
That said, I am currently in the process of designing a disk specifically for doing dialup router/firewall duties that will be somewhat more current and easier to configure than the LRP disk. mail me [mailto] if you are interested.
Re: (Score:1)
No problems for me. (Score:1)
I have played Quake, Quake2, Quake3A Test (1.05 - 1.07) and a whole host of other games on the Internet.
The only problem I have ever had is with FTP clients. I got one that supported pasive mode and everything worked fine.
Re:No problems for me. (Score:1)
For FTP I have used plain old Windows FTP and the GNU version of FTP that comes with BeOS. Both work fine. I used to use WSFTP back when I used WinGate, and it also seems to work with Sygate.
While I do not use ICQ I did see some items about using multiple ICQ clients behind the Sygate server on their FAQs page on their web page:
http://www.sygate.com
As for multiple people playing Quake, have never tried it. I'm the only person in my house that plays Quake(1,2,3A) and I have never seen the need to play it on two computers at the same time (nor would I have the skill, as anyone who has kicked my ass in Quake can tell you).
Re:Ick & additional info about masq apps + battle. (Score:1)
ftp connections break (Score:1)
Or use a DEC Multia (Score:1)
Different DCC prob (Score:1)
-----
If Bill Gates had a nickel for every time Windows crashed...
About the "NAT is evil" articles (Score:1)
The network is still at an very early stage in development compared to the inside of any modern computer. Youll see even more virtualization. That doesnt mean todays NAT solutions are the future, theyre just the beginning and at an early, sometimes very experimental, stage, just like virtual memory wasnt developed overnight. Besides, the virtual network is a lot harder to do than virtual memory: the latter takes place inside one small box, while the virtualization of network resources has consequences for millions of computers simultaenously.
general NAT info:
http://www.csn.tu-chemnitz. de/~mha/linux-ip-nat/diplom/" [tu-chemnitz.de]
--
Michael Hasenstein
http://www.csn.tu-chemnitz.de/~mha/ [tu-chemnitz.de]
You need a specialised setup for each app (Score:2)
*incoming* connections. That is because the
remote system connects to say, port 1234 on the
server that sends the original packet. As this
is apparently the masquerading host, the masq host
does not know where to send the packet on to,
there is no way to connect an arbitrary portnumber
without configuring that portnumber to ALWAYS be accociated with a unique app.
Your only solution is to have your ISP give you a
group of IPs, and assign one for each box
Re:You need a specialised setup for each app (Score:1)
ipmasqadm portfw -a -P tcp -L 25 -R 25
There, I've just forwarded in my mail server. It works with udp as well. You can also add multiple machines and round-robin between them. Do port translation to get around firewalls. Forward out different services to different machines and confuse the hell out of skript kiddies.
Protocols which break behind NAT boxes are doing nasty stuff like including IP and port numbers inside the _data_ layer of the packet, which is arguably a stupid thing to do.
Re:I would think that a 386 would give noticable (Score:1)
naw. I use a 386DX33 with 8 megs and a 120 meg HDD doing voicemail, X10 and internet dialling. no worries there. I mean I"m only connected at 56k so the processor is mostly sitting around. I just gotta get a UPS on the beast so I can get some uptime on it
Re:Straight from the gods? Maybe the fallen one. (Score:1)
-Mars
Something noone else has mentioned: (Score:1)
NAT Problem Workarounds (Score:4)
I have seen a few comments about how evil NAT is. I wholelly agree. But it has it's benefits.
Being able to have any number of IP's that are needed to complete one's network without having to go through the hassle of paying for an IP space is the one at the top of my list for one... Though:
For ease of use I would recommend FreeBSD, it has a better suite for NAT (no flames yet plaese... read the rest.) And my statistics for the box actually say that FreeBSD is faster for doing the networking. (non professional... just watching the D/L rates.)
For functionality I would highly recommend Linux, as it has a much better plug in system for the Masq modules.
I have used both. And had much success with both. But the one thing I will HIGHLY recommend for both operating system platforms is socks5. Most applications are somewhat aware of it, and those that are not can be made aware with some library tricks. I use ICQ and AIM on a windows box behind my firewall with little to no problems at all. The only problem that I see is that sometimes incoming messages are a little slow (have yet to figure that one out, but I'm sure it's a configuration error).
The only other thing that may cause problems is if you are using dynamic dialup. Secure web sites sometimes complain about an invalid reverse name lookup.
I have been happily using a NAT based firewall for about 2 years now both Linux and FreeBSD. I prefer FreeBSD for the networking speed, but that is wholelly my personal opinion.
Re:I bet you use Red Hat 6.0 (Score:1)
Re:Use An Old Mac (Score:1)
Re:Masqd Connections (Score:1)
Re: (Score:1)
Practical and Theoretical NAT Limitations (Score:1)
Various other people pointed to broken protocols, and protocols which need special help. In general, any protocol which does not restrict itself to a single connection (ie. src ip/port dst ip/port quad) will require special assistance. This includes FTP (both passive and active) in the general case, although for simple masquerading passive ftp does not need help.
For static NAT, where an IP address is always mapped the same way (n:n NAT, eg. 192.168.1.* is mapped straight into 1.2.3.*), only protocols which actually include IP addresses within their data stream will be impaired. Unfortunately, FTP is one of these.
A special note on games: Dan Kegel (of Activision) produced a fairly well-thought-out proposal for UDP gaming through NAT. IP masquerading in Linux 2.2 meets this standard.
Here is the draft [caltech.edu]
Rusty.
Not a problem here... almost (Score:1)
With all the appropriate configurations done on the server and the client workstations (ie, port ranges for ICQ) I have had few, if any problems.
I can send and receive files from ICQ, chat with people, even chat with people on my own lan. There is no loss of functionality for me with IP Masq. Some applications require special modules or commands, but once done, it's never an issue.
I'm running Slackware 3(?), with kernel 2.0.36. The machine is so solid that it doesn't have a monitor or keyboard attached to it, and it's only a 486.
I have not tried to do any online gaming with IP Masq.
I can't get full voice with MS netmeeting to work, though I haven't tried too hard. The whiteboard and everything else works fine though.
I do get strange intermittant problems, issues such as people being invited into a four-way-chat only getting a three way chat... when everyone else sees the four. People dissapear who should be visible, lots of peculiar behavior, but nothing show-stopping. I think it is a combination of ICQ running out of incomming TCP connections and a problem with the ICQ servers failing to correctly or timely interpret the status of people with the same IP address or something... most status issues are resolved by changing status back and forth.
I would love to hear people's suggestions about how to fine tune various applications.
ICQ does just fine through socks5 (Score:1)
Commercial sites will run into licensing issues, too.
http://www.socks.nec.com [nec.com]
FreeBSD users see
more additional info about masq apps (Score:1)
Doing so involved the use of yet another experimental kernel networking feature: fwmark forwarding (look for it in the network options in the kernel).
The first thing to do is to find out the port ranges that the gaming system (battle.net, the zone, whatever) need to access.
second thing to do is to (other than being familiar with the firewall & masq tools) is to do a 'man ipmasqadm' and look for the section called mfw.
That should be about it. You might even be able to get multiple boxen to work with at the same time (mfw allows redirection of ports to multiple simultaneous internal machines, if i read the docs correctly).
the third thing, of course, it to get all the command line parameters correct for ipchains and for ipmasqadm
anyway, i hope this helps someone, if you have more questions, email me, but this is most of what i know (it only took me ~30 mins to set it all up -- ms acutally had good docs for what port ranges were required)
NAT & Linux/*BSD (Score:1)
But anyhoo, IPNat under OpenBSD lets me run anything behind it. I can DCC, AIM, ICQ, etc. with no problems.
NAT however is an unfortunate (although extremely cool) side effect of what happens when you begin to run out of IP addresses with IPv4.
-Dave
--
Dave Brooks (db@amorphous.org)
http://www.amorphous.org
Re:Nothing wrong with it. (Score:1)
Re:hmmm.. masq'd connections? (Score:1)
Re:Use a SOCKS5 firewall/proxy (Score:1)
ICQ messages, chat and transfers work through socks with no problems.
However, I have yet to find a windows IRC client with complete SOCKS5 support.. I can get everything BUT outgoing DCC to work with just IPChains.
Frequently, the problem with IRC clients and NAT isn't the NAT itself, but the way the client figures out the local IP. If it uses the IP of the local machine, any direct connections are toast... Most clients (like mIRC) let you either manually specify an IP (a pain under DHCP) or can get it back from the IRC server after you connect.
Quake 2, Ultima Online and any other game I've tried have worked fine with just IPChains, but SOCKSCap is always an option for really wierd things.
Masquerade resources (Score:5)
You can find information there on getting just about any application working with masquerading.
Re:You need a specialised setup for each app (Score:1)
Better yet, use tcp_redir. It's simpler, and its docs are in english (a big bonus for me anyway...)
Re:You need a specialised setup for each app (Score:4)
Check out my "howto" on portfw'ing:
http://www.gargoyle.dyndns.org/linux/portfw-tut
anyway, the webserver itself is behind the IPmasq
Re:How I Do It on Linux (Score:1)
eg:
ftp site.com
ftp> passive
Passive Mode On
ftp> get blah.tar.gz, etc
the ip_masq_ftp module just allows the active FTP
transfers to work. I don't use ip_masq_ftp
and am able to ftp up/down from the net w/out problems. I just need to use passive mode. This is what your browser will use as default when it is downloading via FTP.
Re:Straight from the gods? Maybe the fallen one. (Score:1)
Here's where NAT/masq applications shine. They don't require any changes on the client side. I've been at a firm that used socks, and it is somewhat more difficult because if your application doesn't use the TCP/IP stack like the socks is expecting it, such as with Oracle apps, you're screwed.. With NAT, you're not
Two words: MAN PAGE (Score:1)
Almost everything questioned by the original poster is covered in the FreeBSD natd man page. How do I know this? I learned to read. You should try it.
---
Openstep/NeXTSTEP/Solaris/FreeBSD/Linux/ultrix/OS
Try IPPORTFW/IPMASQADM (Score:1)
You still can't DCC _IN_ directly to a masq'ed client, unless you do a trick: allocate a port for each user and forward the data from that specific port to the assigned user. I haven't tried this under 2.0.x but did get it working once on 2.2.x: the caller aims their DCC to the appropriate port on the masq server instead of trying to hit the masq'ed user directly.
WIth ICQ?? Re:Socks5 Proxy Server (Score:1)
Re:You need a specialised setup for each app (Score:1)
Re:Ummm... (Score:1)
BTW - Anyone know why the ip_masq_icq module hasn't become a regular part of the kernel? And when are we going to get some of the neat Masq'ing features that the 2.0.37ac?? patches have?
How to Stream QT 4 with IP Masquerading... (Score:1)
You need to use the RTSP/RTP proxy (run it on the same box as you're masking from). Works perfectly for me. Builds on a few different platforms.
http://www.apple.com/quicktime/ developers/rtspproxy.html [apple.com]
Dox & source included. Enjoy,
W
-------------------
Re:Masquerade resources (Score:1)
Otherwise, it's hogwash.
It's been in dire need of an update since about 2.0.17
Re:How to do DCC (Score:1)
Thus, it won't work for icq98 or icq99, but it will work with older versions of icq.
The problem is I'm not about to tell my users they should retrograde their icq. So i installed Socks instead.
Ummm... (Score:1)
in response to the question at hand...
solution: use ipfwadm or ipchains
set up correctly with a newer kernel, this will work for everything.- -----
------------------------------------
Reveal your Source, Unleash the Power. (tm)
Re:WIth ICQ?? Re:Socks5 Proxy Server (Score:1)
Nothing wrong with it. (Score:2)
SOCKS works in user mode; I don't see any advantage to that. If you want bidirectional firewall traversal, you could implement similar functionality in the kernel. You need to either notify the firewall machine that a socket on the client is accepting connections and that needs to be forwarded to the firewall machine, or when there is a request coming in, the firewall machine has to try until it finds a machine willing to service it.
Most people don't need, and in fact, don't want that functionality. But people who do already get it: it's part of clustering.
Re:Ummm... (Score:1)
(It's a point of information, not my attempt to make anyone look or feel bad.)
Re:IP Masquerade Resources (Score:1)
Let that be a lesson to you. Always preview before you submit.
Re:Masquerade resources (Score:2)
One thing to be careful of is to make sure you load the modules to keep an eye on the proper ports. I had everything but DCC running, and was scratching my head for a while, until I realized that the ip_masq_irc module which deals with such things was looking at the default (6666?) port, and not any of the others (6667, 7000) that are frequently used.
Seriously. If you need help with IP Masquerading, check out http://ipmasq.cjb.net [cjb.net] ... the IP Masquerade Resources Page. Complete with mini-HOWTOs and links to useful documents like TrinityOS for ensuring your system is remotely secure.
Good luck. It's a little bit of work, but once you wrap your mind around it, it's a piece of cake.
IP Masquerade Resources (Score:2)
http://ipmasq.cjb.net [cjb.net] is the URL for the Linux IP Masquerade Resource page. Once there, consult the IP Masquerade mini-HOWTO (v1.76-Jul18.99), patches for older kernels, the mailing list, the IP masquerade application collection (if you want to configure that one pesky piece of Internet software just right.), the TrinityOS step-by-step documentation for IPMASQ and network security, and even goodies for people on dynamic (gasp!) IP connections.
It's an excellent site, which was truly an invaluable resource when I was trying to put the jumper cables to my own IP MASQ'ing gateway box. Even my Amiga has no problem getting through to the outside world via. the Linux box.
Good luck. It can be a little tricky in spots, but the end result is worth it.
Re:Use Win98 Second Edition (Score:1)
My question is: why must FTP be in passive mode when it is run from a host on a masqueraded net (the gateway itself excepted, of course)?
A Question about timeouts (Score:1)
Is there away to make NAT not drop just telnet tunnels or something? Email me if you like, I'd like to know.
Re:Use Win98 Second Edition (j/k) (Score:1)
Re:Masquerade resources (Score:1)
Re:Something noone else has mentioned: (Score:2)
Re:Use Win98 Second Edition (j/k) (Score:1)
Thanks.
Re:ftp connections break (Score:1)
Doesn't that hurt? }:-O
Re:Use Win98 Second Edition (j/k) (Score:1)
What good is a gateway machine that you have to reboot every six hours, eh?
I know of commercial solutions for Solaris (FW1E for example) that are EXCELLENT.
Novell has one too that allows quake and stuff too. I haven't played with that one much.
Re:RTSP - Quicktime Streaming (Score:1)
RealAudio/Video uses HTTP which is widely supported but far less efficient. Funny thing is that I am using NAT on my Cisco router and RTSP fails, even though Cisco supports RTSP for CiscoTV. So much for Cisco supporting standards.
I'm about to spark up my Novell Border Manager to see if it supports RTSP and if Novell's NAT works.
Re:Use a SOCKS5 firewall/proxy (Score:1)
The only drawback to socks5 proxies that I can find is that it doesn't do ICMP packets (ie PING)
You can get a free socks5 client for win95 that basically replaces winsock so you don't have to configure all your software for proxy. I don't think there is such a client product for Linux but I could be wrong. (that just means you have to set proxy settings in netscape, ICQ etc.
Re:MASQing at an ISP (Score:1)
I've got DSL and Internet through USWest (which is huge, and getting even huger merging with Qwest), who used to op for a straight bridging scheme through a Cisco 675 "DSL Modem." No problem. I set it up with a Linux box that I masq'd and put lots of Microsoft boxen behind. Just a couple days ago, though, USWest decides to get freaky and set it up so the Cisco gets a dynamic IP, and then itself acts as a DHCP server for any machines behind it (non-routable private use IPs, 10.0.0.0) and it uses NAT! SUCK! So now, I've got packets traversing two layers of NAT/masq grimore. Almost nothing works.
The moral of the story is, even if you're only going to connect one computer (by the way, USWest does NOT support Unix at all) don't sign up with USWest as an ISP. No lovin' at all. [Well, I guess the actual DSL service is pretty good. Only one outage in over 8 months.]
OK, I be shut up.
/ c l o c k w o r k /
Re:Masqd Connections (Score:2)
Just out of curiosity, has anyone tried out WinGate 3.0 for windows?
documentation, documentation, doucmentation (Score:1)
Re:Straight from the gods? Maybe the fallen one. (Score:1)
Use Win98 Second Edition (j/k) (Score:1)
How to do DCC (Score:2)
/sbin/modprobe ip_masq_irc
do:
/sbin/modprobe ip_masq_irc ports=6667,7000
and add whatever ports you use for IRC in the ports. I had this same problem about a week ago and a friend was kind enough to let me in on the secret.
It works for me - ooops (Score:1)
I have no problems with any icq function, you just have to make sure that you tell it you are behind a firewall, and that you dont use a socks 4/5 server...as for quake, it works just fine, make sure the quake module is loaded on your linux box...
masq servers cant accept incoming connections to you, so you'll have to initiate them if you want to do something...
El Guapo
Re:RSIP (Score:1)
http://www. ietf.org/internet-drafts/draft-ietf-nat-rsip-prot
Bryan R.
HOWTO to the rescue... (Score:1)
Re:Use Win98 Second Edition (j/k) (Score:1)
It works if you know what you are doing... (Score:1)
Most of your faults can be worked around, such as ICQ file transfers, e.g. port forwarding. Games work fine, I play Quake 2 and 3 all the time through my firewall
-ShieldWolf
DCC (Score:1)
modprobe ip_masq_irc ports=6666,6667,6668,6669,7000
Works fine for me on Linux 2.2.5 and 2.2.10. Not sure about BSD though.
Re:hmmm.. masq'd connections? (Score:1)
Use An Old Mac (Score:1)
Re:Use Win98 Second Edition (j/k) (Score:2)
IRC dcc sends from behind the NAT (Score:1)
Line 172, comment out:
if (xtra_args != 0) continue;
Lines 178-182, comment out:
if (data[0] != 0x01)
continue;
if (data[1]!='\r' && data[1]!='\n')
continue;
Then make clean;make modules;make modules_install, quit irc, wait 60 seconds for the connections to timeout, rmmod ip_masq_irc;modprobe ip_masq_irc and you're set. This is a kludge, but it works.
Standards (Score:2)
How (Score:2)
As programmers we can improve competitors' products who are following standards. As customers we can avoid proprietary products, just as we did with MicroChannel. As reviewers we can mention if products use proprietary methods or standards.
The AOL and MS messaging customers and tech support are getting lessons in that right now.
Re:I bet you use Red Hat 6.0 (Score:2)
ICQ file transfers.
FTP with some *cough* windows clients.
I am able to play any net multiplayer game I want, I run a Q3Test server from behind the 486 using port-forwarding. Works great. Only issue I had was registering my game server with the id master.
Masquerading gets the registration packets, and masqs them out, except it changes the source port. This fouls up the works since game ports are expected to be 27960 and I show up with 62345 or some other randome port number generated by masquerading. To get around this, I use a helper that runs on the firewall that sniffs for the registration packets then writes out a copy from the correct port.
When I got the program, it was set up for half-life. I made a couple quick changes to get it to work for Q3Test, but it probably could be easilty converted for any game server that sends out similar registration packets (Quake2, Sin, Blood, Shogo, etc.)
Re:Use Win98 Second Edition (j/k) (Score:2)
My masq/portfw/gateway/firewall is a 486/100 with 16m running a 2.0.36 kernel on a 202 Mb hard drive. I laid hands on a couple SMC ISA NICs and an ATI mach 8 at a swap-meet and I was in business for about $30. Before I set this up, I was using a PPro 200 with 64mb to run Win98 and Sygate. This did actually work ok, except for having to reboot it when it froze every couple days. (now the ppro is running Debian doing Q2 server duty). Its a real shame you have to run an OS with an integrated GUI and web browser just to do a simple chore like NAT.
And the only real shortcoming I have with my setup is ICQ file transfers, but what I do anyway is set up FTP access for friends that need to send files. Granted, I don't do this very often and it wouldn't be practical for someone trading pr0n with strangers they meet on ICQ.
Re:I would think that a 386 would give noticable (Score:2)
Re:Use Win98 Second Edition (j/k) (Score:2)
One gotcha, though, the Win98SE machine has to be "logged in" for it to work, it seems.
How I Do It on Linux (Score:5)
which returns:
Then I (as root):
This adds the ability to do ftp from a masq't machine, or does for me. There are other protocols, such as for RealAudio. Grepping on "masq" will find 'em.
Ie:
I'm not sure that the loaded module persists if it isn't called for a while. There are parameters governing this sort of thing. You can also add the line to your
Looking forward to seeing other solutions! (Far as I can tell, I'm first post.)
Anyway, gives you a place to manpage if nothing else....
-K
Re:Use Win98 Second Edition (j/k) (Score:2)
Re:Something noone else has mentioned: (Score:2)
i've never actually tried this myself, but know some people who have...