What is MASQUERADE in the context of iptables?
In iptables many times I see the target MASQUERADE. What is that? I searched and found lots of things. But I need someone to explain to me what MASQUERADE is in an easy to understand way?
An example (taken from this answer) is:
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
networking firewall iptables
edited Dec 14 '17 at 19:15
Bruno Bronosky
50349
asked May 15 '14 at 16:07
Mohammad Reza RezwaniMohammad Reza Rezwani
3,7292563110
add a comment |
In iptables many times I see the target MASQUERADE. What is that? I searched and found lots of things. But I need someone to explain to me what MASQUERADE is in an easy to understand way?
An example (taken from this answer) is:
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
networking firewall iptables
edited Dec 14 '17 at 19:15
Bruno Bronosky
50349
asked May 15 '14 at 16:07
Mohammad Reza RezwaniMohammad Reza Rezwani
3,7292563110
add a comment |
In iptables many times I see the target MASQUERADE. What is that? I searched and found lots of things. But I need someone to explain to me what MASQUERADE is in an easy to understand way?
An example (taken from this answer) is:
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
networking firewall iptables
edited Dec 14 '17 at 19:15
Bruno Bronosky
50349
asked May 15 '14 at 16:07
Mohammad Reza RezwaniMohammad Reza Rezwani
3,7292563110
In iptables many times I see the target MASQUERADE. What is that? I searched and found lots of things. But I need someone to explain to me what MASQUERADE is in an easy to understand way?
An example (taken from this answer) is:
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
networking firewall iptables
networking firewall iptables
edited Dec 14 '17 at 19:15
Bruno Bronosky
50349
asked May 15 '14 at 16:07
Mohammad Reza RezwaniMohammad Reza Rezwani
3,7292563110
edited Dec 14 '17 at 19:15
Bruno Bronosky
50349
asked May 15 '14 at 16:07
Mohammad Reza RezwaniMohammad Reza Rezwani
3,7292563110
edited Dec 14 '17 at 19:15
Bruno Bronosky
50349
edited Dec 14 '17 at 19:15
Bruno Bronosky
50349
edited Dec 14 '17 at 19:15
Bruno Bronosky
50349
50349
asked May 15 '14 at 16:07
Mohammad Reza RezwaniMohammad Reza Rezwani
3,7292563110
asked May 15 '14 at 16:07
Mohammad Reza RezwaniMohammad Reza Rezwani
3,7292563110
asked May 15 '14 at 16:07
Mohammad Reza RezwaniMohammad Reza Rezwani
3,7292563110
3,7292563110
add a comment |
add a comment |
2 Answers
2
active
oldest
votes
It is an algorithm dependant on the iptables implementation that allows one to route traffic without disrupting the original traffic.
I use the masquerade algorithm when I want to create a virtual wifi adapter and share my wifi.
Im NOT talking about sharing Ethernet connection through your wifi, Im talking about sharing the wifi connection through your wifi via masquerading it to a virtual adapter. This in effect lets you share your wifi connection through wifi.
.
.
Read this and scroll down to MASQUERADE: http://billauer.co.il/ipmasq-html.html
Read this for more in depth: http://oreilly.com/openbook/linag2/book/ch11.html
All those questions about "Connectify for linux" can be solved by implementing the MASQUERADE algo.
For a direct example visit this page: http://pritambaral.com/2012/05/connectify-for-linux-wireless-hotspot/
I HAVE NOT READ THE LAST LINK!!!! But the following is an accurate excerpt/example.
sudo sysctl -w net.ipv4.ip_forward=1
sudo iptables -A FORWARD -i wlan0 -j ACCEPT
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
I really dislike how search engines make the algorithm out to be some evil type of hack.. I use it merely so share my internet with my android phones.
FINAL EDIT: this link is the bestest http://gsp.com/cgi-bin/man.cgi?section=3&topic=libalias
answered May 15 '14 at 16:15
Banned_UserBanned_User
6981715
like your first link that was --exactly-- what I am looking for :)
– Mohammad Reza Rezwani
May 15 '14 at 16:29
add a comment |
MASQUERADE is an iptables target that can be used instead of SNAT target (source NAT) when external ip of the inet interface is not known at the moment of writing the rule (when server gets external ip dynamically).
answered May 15 '14 at 16:21
Sergey P. aka azureSergey P. aka azure
1,096911
What should be used when the IP address is known?
– Luc
Nov 28 '16 at 8:55
3
@Luc, SNAT target (source network address translation) with defining source ip that should be placed instead of original source ip in the ip packet from original host. Like this-j SNAT --to-source xx.xx.xx.xxwhere xx.xx.xx.xx is the external ip of the desired interface. And I can't say that it should be used when external ip is known. I'd prefer to use MASQUERADE instead of SNAT to make rules flexible and not bound to specific external ip that I have at the moment.
– Sergey P. aka azure
Dec 6 '16 at 10:08
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "89"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f466445%2fwhat-is-masquerade-in-the-context-of-iptables%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
It is an algorithm dependant on the iptables implementation that allows one to route traffic without disrupting the original traffic.
I use the masquerade algorithm when I want to create a virtual wifi adapter and share my wifi.
Im NOT talking about sharing Ethernet connection through your wifi, Im talking about sharing the wifi connection through your wifi via masquerading it to a virtual adapter. This in effect lets you share your wifi connection through wifi.
.
.
Read this and scroll down to MASQUERADE: http://billauer.co.il/ipmasq-html.html
Read this for more in depth: http://oreilly.com/openbook/linag2/book/ch11.html
All those questions about "Connectify for linux" can be solved by implementing the MASQUERADE algo.
For a direct example visit this page: http://pritambaral.com/2012/05/connectify-for-linux-wireless-hotspot/
I HAVE NOT READ THE LAST LINK!!!! But the following is an accurate excerpt/example.
sudo sysctl -w net.ipv4.ip_forward=1
sudo iptables -A FORWARD -i wlan0 -j ACCEPT
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
I really dislike how search engines make the algorithm out to be some evil type of hack.. I use it merely so share my internet with my android phones.
FINAL EDIT: this link is the bestest http://gsp.com/cgi-bin/man.cgi?section=3&topic=libalias
answered May 15 '14 at 16:15
Banned_UserBanned_User
6981715
like your first link that was --exactly-- what I am looking for :)
– Mohammad Reza Rezwani
May 15 '14 at 16:29
add a comment |
It is an algorithm dependant on the iptables implementation that allows one to route traffic without disrupting the original traffic.
I use the masquerade algorithm when I want to create a virtual wifi adapter and share my wifi.
Im NOT talking about sharing Ethernet connection through your wifi, Im talking about sharing the wifi connection through your wifi via masquerading it to a virtual adapter. This in effect lets you share your wifi connection through wifi.
.
.
Read this and scroll down to MASQUERADE: http://billauer.co.il/ipmasq-html.html
Read this for more in depth: http://oreilly.com/openbook/linag2/book/ch11.html
All those questions about "Connectify for linux" can be solved by implementing the MASQUERADE algo.
For a direct example visit this page: http://pritambaral.com/2012/05/connectify-for-linux-wireless-hotspot/
I HAVE NOT READ THE LAST LINK!!!! But the following is an accurate excerpt/example.
sudo sysctl -w net.ipv4.ip_forward=1
sudo iptables -A FORWARD -i wlan0 -j ACCEPT
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
I really dislike how search engines make the algorithm out to be some evil type of hack.. I use it merely so share my internet with my android phones.
FINAL EDIT: this link is the bestest http://gsp.com/cgi-bin/man.cgi?section=3&topic=libalias
answered May 15 '14 at 16:15
Banned_UserBanned_User
6981715
like your first link that was --exactly-- what I am looking for :)
– Mohammad Reza Rezwani
May 15 '14 at 16:29
add a comment |
It is an algorithm dependant on the iptables implementation that allows one to route traffic without disrupting the original traffic.
I use the masquerade algorithm when I want to create a virtual wifi adapter and share my wifi.
Im NOT talking about sharing Ethernet connection through your wifi, Im talking about sharing the wifi connection through your wifi via masquerading it to a virtual adapter. This in effect lets you share your wifi connection through wifi.
.
.
Read this and scroll down to MASQUERADE: http://billauer.co.il/ipmasq-html.html
Read this for more in depth: http://oreilly.com/openbook/linag2/book/ch11.html
All those questions about "Connectify for linux" can be solved by implementing the MASQUERADE algo.
For a direct example visit this page: http://pritambaral.com/2012/05/connectify-for-linux-wireless-hotspot/
I HAVE NOT READ THE LAST LINK!!!! But the following is an accurate excerpt/example.
sudo sysctl -w net.ipv4.ip_forward=1
sudo iptables -A FORWARD -i wlan0 -j ACCEPT
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
I really dislike how search engines make the algorithm out to be some evil type of hack.. I use it merely so share my internet with my android phones.
FINAL EDIT: this link is the bestest http://gsp.com/cgi-bin/man.cgi?section=3&topic=libalias
answered May 15 '14 at 16:15
Banned_UserBanned_User
6981715
It is an algorithm dependant on the iptables implementation that allows one to route traffic without disrupting the original traffic.
I use the masquerade algorithm when I want to create a virtual wifi adapter and share my wifi.
Im NOT talking about sharing Ethernet connection through your wifi, Im talking about sharing the wifi connection through your wifi via masquerading it to a virtual adapter. This in effect lets you share your wifi connection through wifi.
.
.
Read this and scroll down to MASQUERADE: http://billauer.co.il/ipmasq-html.html
Read this for more in depth: http://oreilly.com/openbook/linag2/book/ch11.html
All those questions about "Connectify for linux" can be solved by implementing the MASQUERADE algo.
For a direct example visit this page: http://pritambaral.com/2012/05/connectify-for-linux-wireless-hotspot/
I HAVE NOT READ THE LAST LINK!!!! But the following is an accurate excerpt/example.
sudo sysctl -w net.ipv4.ip_forward=1
sudo iptables -A FORWARD -i wlan0 -j ACCEPT
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
I really dislike how search engines make the algorithm out to be some evil type of hack.. I use it merely so share my internet with my android phones.
FINAL EDIT: this link is the bestest http://gsp.com/cgi-bin/man.cgi?section=3&topic=libalias
answered May 15 '14 at 16:15
Banned_UserBanned_User
6981715
edited May 15 '14 at 16:37
answered May 15 '14 at 16:15
Banned_UserBanned_User
6981715
answered May 15 '14 at 16:15
Banned_UserBanned_User
6981715
answered May 15 '14 at 16:15
Banned_UserBanned_User
6981715
6981715
like your first link that was --exactly-- what I am looking for :)
– Mohammad Reza Rezwani
May 15 '14 at 16:29
add a comment |
like your first link that was --exactly-- what I am looking for :)
– Mohammad Reza Rezwani
May 15 '14 at 16:29
like your first link that was --exactly-- what I am looking for :)
– Mohammad Reza Rezwani
May 15 '14 at 16:29
like your first link that was --exactly-- what I am looking for :)
– Mohammad Reza Rezwani
May 15 '14 at 16:29
add a comment |
MASQUERADE is an iptables target that can be used instead of SNAT target (source NAT) when external ip of the inet interface is not known at the moment of writing the rule (when server gets external ip dynamically).
answered May 15 '14 at 16:21
Sergey P. aka azureSergey P. aka azure
1,096911
What should be used when the IP address is known?
– Luc
Nov 28 '16 at 8:55
3
@Luc, SNAT target (source network address translation) with defining source ip that should be placed instead of original source ip in the ip packet from original host. Like this-j SNAT --to-source xx.xx.xx.xxwhere xx.xx.xx.xx is the external ip of the desired interface. And I can't say that it should be used when external ip is known. I'd prefer to use MASQUERADE instead of SNAT to make rules flexible and not bound to specific external ip that I have at the moment.
– Sergey P. aka azure
Dec 6 '16 at 10:08
add a comment |
MASQUERADE is an iptables target that can be used instead of SNAT target (source NAT) when external ip of the inet interface is not known at the moment of writing the rule (when server gets external ip dynamically).
answered May 15 '14 at 16:21
Sergey P. aka azureSergey P. aka azure
1,096911
What should be used when the IP address is known?
– Luc
Nov 28 '16 at 8:55
3
@Luc, SNAT target (source network address translation) with defining source ip that should be placed instead of original source ip in the ip packet from original host. Like this-j SNAT --to-source xx.xx.xx.xxwhere xx.xx.xx.xx is the external ip of the desired interface. And I can't say that it should be used when external ip is known. I'd prefer to use MASQUERADE instead of SNAT to make rules flexible and not bound to specific external ip that I have at the moment.
– Sergey P. aka azure
Dec 6 '16 at 10:08
add a comment |
MASQUERADE is an iptables target that can be used instead of SNAT target (source NAT) when external ip of the inet interface is not known at the moment of writing the rule (when server gets external ip dynamically).
answered May 15 '14 at 16:21
Sergey P. aka azureSergey P. aka azure
1,096911
MASQUERADE is an iptables target that can be used instead of SNAT target (source NAT) when external ip of the inet interface is not known at the moment of writing the rule (when server gets external ip dynamically).
answered May 15 '14 at 16:21
Sergey P. aka azureSergey P. aka azure
1,096911
answered May 15 '14 at 16:21
Sergey P. aka azureSergey P. aka azure
1,096911
answered May 15 '14 at 16:21
Sergey P. aka azureSergey P. aka azure
1,096911
answered May 15 '14 at 16:21
Sergey P. aka azureSergey P. aka azure
1,096911
1,096911
What should be used when the IP address is known?
– Luc
Nov 28 '16 at 8:55
3
@Luc, SNAT target (source network address translation) with defining source ip that should be placed instead of original source ip in the ip packet from original host. Like this-j SNAT --to-source xx.xx.xx.xxwhere xx.xx.xx.xx is the external ip of the desired interface. And I can't say that it should be used when external ip is known. I'd prefer to use MASQUERADE instead of SNAT to make rules flexible and not bound to specific external ip that I have at the moment.
– Sergey P. aka azure
Dec 6 '16 at 10:08
add a comment |
What should be used when the IP address is known?
– Luc
Nov 28 '16 at 8:55
3
@Luc, SNAT target (source network address translation) with defining source ip that should be placed instead of original source ip in the ip packet from original host. Like this-j SNAT --to-source xx.xx.xx.xxwhere xx.xx.xx.xx is the external ip of the desired interface. And I can't say that it should be used when external ip is known. I'd prefer to use MASQUERADE instead of SNAT to make rules flexible and not bound to specific external ip that I have at the moment.
– Sergey P. aka azure
Dec 6 '16 at 10:08
What should be used when the IP address is known?
– Luc
Nov 28 '16 at 8:55
What should be used when the IP address is known?
– Luc
Nov 28 '16 at 8:55
3
3
@Luc, SNAT target (source network address translation) with defining source ip that should be placed instead of original source ip in the ip packet from original host. Like this
-j SNAT --to-source xx.xx.xx.xx where xx.xx.xx.xx is the external ip of the desired interface. And I can't say that it should be used when external ip is known. I'd prefer to use MASQUERADE instead of SNAT to make rules flexible and not bound to specific external ip that I have at the moment.– Sergey P. aka azure
Dec 6 '16 at 10:08
@Luc, SNAT target (source network address translation) with defining source ip that should be placed instead of original source ip in the ip packet from original host. Like this
-j SNAT --to-source xx.xx.xx.xx where xx.xx.xx.xx is the external ip of the desired interface. And I can't say that it should be used when external ip is known. I'd prefer to use MASQUERADE instead of SNAT to make rules flexible and not bound to specific external ip that I have at the moment.– Sergey P. aka azure
Dec 6 '16 at 10:08
add a comment |
Thanks for contributing an answer to Ask Ubuntu!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f466445%2fwhat-is-masquerade-in-the-context-of-iptables%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
