2.7. Requirements for IP Masquerade on Linux 2.2.x

" ** Please refer to IP Masquerade Resource for the latest information. ** "

• Any decent computer hardware. See Section 7.2 for more details.

• The 2.2.x kernel source is available from http://www.kernel.org/.

  NOTE: Most modern Linux distributions, Section 7.1, that natively come with 2.2.x kernels are typically modular kernels and have all the IP Masquerade functionality already included. In such cases, there is no need to compile a new Linux kernel. If you are UPGRADING your kernel, you should be aware of other programs that might be required and/or need to be upgraded as well (mentioned later in this HOWTO).

  • NOTE #1: --- UPDATE YOUR KERNEL --- Linux 2.2.x kernels less than version 2.2.20 contain several different security vulnerabilities (some were MASQ specific). Kernels less than 2.2.20 have a few local vulnerabilities. Kernel versions less than 2.2.16 have a TCP root exploit vulnerability and versions less than 2.2.11 have a IPCHAINS fragmentation bug. Because of these issues, users running a firewall with strong IPCHAINS rulesets are open to possible instrusion. Please upgrade your kernel to a fixed version.

• NOTE #2: Some newer Section 7.1 such as Redhat 5.2 might not be Linux 2.2.x ready (upgradable). Tools like DHCP, NetUtils, etc. will need to be upgraded. More details can be found later in the HOWTO.

• Loadable kernel modules, preferably 2.1.121 or higher, are available from http://home.pi.se/blox/modutils/index.html or ftp://ftp.kernel.org/pub/linux/utils/kernel/modutils

• A properly configured and running TCP/IP network running on the Linux machine as covered in Linux NET HOWTO and the Network Administrator's Guide . Also check out the TrinityOS document which is also authored by David Ranch. TrinityOS is a very comprehensive guide for Linux networking. Some topics include IP MASQ, security, DNS, DHCP, Sendmail, PPP, Diald, NFS, IPSEC-based VPNs, and performance sections, to name a few. There are over Fifty sections in all!

• Connectivity to the Internet for your Linux host covered in Linux ISP Hookup HOWTO, Linux PPP HOWTO, and TrinityOS. Other helpful HOWTOs could include: Linux DHCP mini-HOWTO, Linux Cable Modem mini-HOWTO and http://www.tldp.org/HOWTO/DSL-HOWTO/index.html

• IP Chains 1.3.10 or newer are available from http://www.netfilter.org/ipchains/. Additional information on version requirements for the newest IPCHAINS HOWTO, etc is located at the Linux IP Chains page (mirror at Samba.org)

• Know how to configure, compile, and install a new Linux kernel as described in the Linux Kernel HOWTO. This HOWTO does cover kernel compiling but only for IP Masquerade related options.

Other optional patches and tools for 2.2.x kernels

• TCP/IP port-forwarding or re-directing:

  • IP PortForwarding (IPMASQADM) - RECOMMENDED - mirror

• PORTFW FTP Solutions:

  • There are 2.2.x and 2.0.x kernel MASQ Module solutions for PORTFWed FTP to a MASQed machine (put an FTP server behind a MASQ server). Please see the Application Page on the IPMASQ WWW site for full details. Please note that this is not required for 2.4.x kernels.

    There is a full FTP proxy application from SuSe that will also allow PORTFWed-like functionality to reach an internal FTP server. For more details, please refer to the SuSe Proxy URL.

• IPROUTE2 for True 1:1 NAT, Policy-based (source) routing, and Traffic Shaping:

  • ftp://ftp.inr.ac.ru/ip-routing

  • Documentation can be found at http://www.compendium.com.ar/policy-routing.txt

  • The Advanced Routing HOWTO

  • Some source code mirrors are at:

    ftp://ftp.funet.fi/pub/mirrors/ftp.inr.ac.ru/ip-routing/ (STM1 to USA) --- ftp://sunsite.icm.edu.pl/pub/Linux/iproute/

    ftp://ftp.sunet.se/pub/Linux/ip-routing/ --- ftp://ftp.nvg.ntnu.no/pub/linux/ip-routing/

    ftp://ftp.crc.ca/pub/systems/linux/ip-routing/ --- ftp://ftp.paname.org (France)

Please see the IP Masquerade Resource page for more information available on these patches and possibly others as well.