|
|
637.
|
|
|
The purpose of IP Masquerading is to allow machines with private, non-routable IP addresses on your network to access the Internet through the machine doing the masquerading. Traffic from your private network destined for the Internet must be manipulated for replies to be routable back to the machine that made the request. To do this, the kernel must modify the <emphasis>source</emphasis> IP address of each packet so that replies will be routed back to it, rather than to the private IP address that made the request, which is impossible over the Internet. Linux uses <emphasis>Connection Tracking</emphasis> (conntrack) to keep track of which connections belong to which machines and reroute each return packet accordingly. Traffic leaving your private network is thus "masqueraded" as having originated from your Ubuntu gateway machine. This process is referred to in Microsoft documentation as Internet Connection Sharing.
|
|
|
|
|
IP 偽裝的目的是為了允許您網路上那些有著私有的、不可路由的IP地址的機器可以通過做偽裝的機器訪問Internet。來自您私有網路並要訪問 Internet的傳輸必須是可以manipulated的，也就是說回復要可以被路由回來以送到發出請求的機器上。要做到這一點，內核必須修改<emphasis>source</emphasis> IP地址以便回復能被路由回它這裡，而不是發出請求的私有IP地址，因為它們對於Internet來說是不存在的。 Linux使用<emphasis>Connection Tracking</emphasis> (conntrack)以掌握其中的連接屬於哪個機器和每一個新創公司的回報包。交通，讓你的專用網路，因此" masqueraded " ，有來自你的Ubuntu gateway機器。這個過程是指在微軟的文件作為Internet連接共享。
|
|
Translated and reviewed by
yugu
|
|
|
|
Located in
serverguide/C/security.xml:597(para)
|
|
|
638.
|
|
|
ufw Masquerading
|
|
|
|
|
(no translation yet)
|
|
|
|
Located in
serverguide/C/security.xml:613(title)
|
|
|
639.
|
|
|
IP Masquerading can be achieved using custom <application>ufw</application> rules. This is possible because the current back-end for <application>ufw</application> is <application>iptables-restore</application> with the rules files located in <filename>/etc/ufw/*.rules</filename>. These files are a great place to add legacy iptables rules used without <application>ufw</application>, and rules that are more network gateway or bridge related.
|
|
|
|
|
(no translation yet)
|
|
|
|
Located in
serverguide/C/security.xml:614(para)
|
|
|
640.
|
|
|
The rules are split into two different files, rules that should be executed before <application>ufw</application> command line rules, and rules that are executed after <application>ufw</application> command line rules.
|
|
|
|
|
(no translation yet)
|
|
|
|
Located in
serverguide/C/security.xml:620(para)
|
|
|
641.
|
|
|
First, packet forwarding needs to be enabled in <application>ufw</application>. Two configuration files will need to be adjusted, in <filename>/etc/default/ufw</filename> change the <emphasis>DEFAULT_FORWARD_POLICY</emphasis> to <quote>ACCEPT</quote>:
|
|
|
|
|
(no translation yet)
|
|
|
|
Located in
serverguide/C/security.xml:626(para)
|
|
|
642.
|
|
|
DEFAULT_FORWARD_POLICY="ACCEPT"
|
|
|
represents a line break.
Start a new line in the equivalent position in the translation.
|
|
|
|
|
(no translation yet)
|
|
|
|
Located in
serverguide/C/security.xml:630(programlisting)
|
|
|
643.
|
|
|
Then edit <filename>/etc/ufw/sysctl.conf</filename> and uncomment:
|
|
|
|
|
(no translation yet)
|
|
|
|
Located in
serverguide/C/security.xml:633(para)
|
|
|
644.
|
|
|
net.ipv4.ip_forward=1
|
|
|
represents a line break.
Start a new line in the equivalent position in the translation.
|
|
|
|
|
(no translation yet)
|
|
|
|
Located in
serverguide/C/security.xml:714(programlisting)
|
|
|
645.
|
|
|
Similarly, for IPv6 forwarding uncomment:
|
|
|
|
|
(no translation yet)
|
|
|
|
Located in
serverguide/C/security.xml:639(para)
|
|
|
646.
|
|
|
net.ipv6.conf.default.forwarding=1
|
|
|
represents a line break.
Start a new line in the equivalent position in the translation.
|
|
|
|
|
(no translation yet)
|
|
|
|
Located in
serverguide/C/security.xml:720(programlisting)
|
