Bsrgvty

In iptables many times I see the target MASQUERADE. What is that? I searched and found lots of things. But I need someone to explain to me what MASQUERADE is in an easy to understand way?

An example (taken from this answer) is:

sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

It is an algorithm dependant on the iptables implementation that allows one to route traffic without disrupting the original traffic.

I use the masquerade algorithm when I want to create a virtual wifi adapter and share my wifi.

Im NOT talking about sharing Ethernet connection through your wifi, Im talking about sharing the wifi connection through your wifi via masquerading it to a virtual adapter. This in effect lets you share your wifi connection through wifi.

.

.

Read this and scroll down to MASQUERADE: http://billauer.co.il/ipmasq-html.html

Read this for more in depth: http://oreilly.com/openbook/linag2/book/ch11.html

All those questions about "Connectify for linux" can be solved by implementing the MASQUERADE algo.

For a direct example visit this page: http://pritambaral.com/2012/05/connectify-for-linux-wireless-hotspot/

I HAVE NOT READ THE LAST LINK!!!! But the following is an accurate excerpt/example.

sudo sysctl -w net.ipv4.ip_forward=1
sudo iptables -A FORWARD -i wlan0 -j ACCEPT
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

I really dislike how search engines make the algorithm out to be some evil type of hack.. I use it merely so share my internet with my android phones.

FINAL EDIT: this link is the bestest http://gsp.com/cgi-bin/man.cgi?section=3&topic=libalias

MASQUERADE is an iptables target that can be used instead of SNAT target (source NAT) when external ip of the inet interface is not known at the moment of writing the rule (when server gets external ip dynamically).

IP Masquerade is also known as Network Address Translation (NAT) and Network Connection Sharing some other popular operating systems. It is basically a method for allowing a computer that doesn't have a public Internet wide IP address communicate with other computers on the Internet with the help of another computer sitting inbetween it and the Internet.

As you know IP address are used on the Internet to identify machines. Given a packet with an IP address, every router that makes up the Internet knows where to send that packet to get it to its destination. Now, there are also a few ranges of IP addresses that have been reserved for private use inside Local Area Networks and other networks that are not directly connected to the Internet. These private addresses are guaranteed not to be in use on the public Internet.

This causes problems for machines that are connected to private networks are use private IP addresses, because they can't be connected directly to the Internet. They don't have an IP address that is allowed to be used on the public Internet. IP Masquerade solves this problem by allowing a machine with a private IP address to communicate with the Internet, while at the same time modifying the machine's packets to use a valid public IP address instead of the original private IP address. Packets returning from the Internet are modified back to use the original IP address before reaching private IP machine.

Note that this is not limited to the internet network masquerade/NAT can be used to route traffic from one network to an other let say 10.0.0.0/24 and 192.168.0.0/24

Iptables masquerade rule can be replaced with SNAT rule

iptables -t nat -A POSTROUTING -o eth2 -s 10.0.0.0/24 -j MASQUERADE

=

iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -o eth2 -j SNAT --to-source 192.168.1.2
# supposing eth2 assigned ip is 192.168.1.2

Both masquerade and snat require ip_forward enabled at the kernel level with echo "1" > /proc/sys/net/ipv4/ip_forward or permanently by editing the settings file nano /etc/sysctl.conf.

IP Forward makes the machine act like a router and thus redirect/forward packets from all active interface logically by the targeted network (local/net/other/etc) or by following the route table. Note that enabling ip_forward may introduce important security risk, if ip_forward can not be avoided, it needs to be supervised/secured by additional iptables/route rules.