Transparent gateway: run IPchains on Linux

Article title: transparent gateway: run IPchains on Linux. Linux is a technology channel of the IT lab in China. Includes basic categories such as desktop applications, Linux system management, kernel research, embedded systems, and open source.
　　 I. Preface
In many universities and research institutions, there are not many legal ip addresses and ports. Therefore, many departments use Proxy servers to access the internet. it is convenient to use Microsoft's Proxy Server, but it is inefficient and has poor performance, and the most important thing is that the cost is too high. Therefore, using a cheap Linux server as a proxy to access the Internet has become a good solution. After several days of debugging, I used Linux as a transparent gateway server, so that other machines in the dormitory can share a port to access the Internet through a Linux machine. I feel very good. The implementation method is to set IP camouflage.
　　
　　 II. Background
Machine 0:
OS: Redhat 6.0, dual Nic installed successfully
　　　　
Eth0: 192.168.2.61, connected to the campus network
Eth0's NetMask: 255.255.254.0
　　　　
Eth1: 192.168.11.1, connected to the dormitory Lan
Eth1's NetMask 255.255.255.0
　　
The IP address of the dormitory Lan is a custom IP address, which is an invalid IP address.
Machine 1:
OS: Win9x
IP: 192.168.11.2
GateWay: 192.168.11.1/* eth1 of machine 0 */
NetMak: 255.255.255.0
DNS: 202.116.64.3/* name server of the campus network */
　　
　　 III. purpose
So that Machine 1 can be connected to the campus network through machine 0, just as Machine 1 is directly connected to the campus network. Therefore, machine 0 is called a transparent gateway.
　　
　　 IV. Principles
Because only the IP address of machine 0 is a valid address, Machine 1 needs to pass the packets sent by Machine 1 through the disguise of machine 0 and then forward them out. During this period, machine 0 extracts and stores the local IP address from the IP packet of Machine 1, in addition, the local address of machine 0 is used instead of the local address, and then the data packet forwarded to the returned data is restored by machine 0 and then forwarded to Machine 1.
　　
　　 Step 5
1. ensure that machine 0 can go out of the campus network, Ping Machine 1, and Ping machine 0. As for how to set it out, we will not discuss it this time.
　　
2. open xwindows on machine 0 and run: netcfg select routing to allow (enable) Network Packet Forwarding (IPV4 ). Create a file on machine 0: rules chmod + x rules to change rules to an executable file.
　　
= (Echo 1>/proc/sys/net/ipv4/ip_forward)
　　　　
3. create a rules File. the specific path can be put in/sbin. Edit this file and enter the following content:
　　
# Deny all ip forwarding by default .. 0
/Sbin/ipchains-P forward DENY
　　
# Allow the dormitory network to use ip forwarding through machine 0. for ipchains, see man ipchains or ipchains how to (refer to building ipchains-based Linux firewall on our site)
/Sbin/ipchains-A forward-j ACCEPT-I eth1-s 192.168.0.0/24
/Sbin/ipchains-A forward-j MASQ-I eth0-s 192.168.0.0/24
# Add the camouflage module you need.
/Sbin/modprobe ip_masq_ftp
/Sbin/modprobe ip_masq_quake
/Sbin/modprobe ip_masq_irc
/Sbin/modprobe ip_masq_user
/Sbin/modprobe ip_masq_raudio
　　
4. run/sbin/rules.
　　
If you add the run rules command to/etc/rc. d/rc. local, ipchains can be automatically executed at startup. This method is also applicable to dial-up Internet access.
　　
　　 6. simple method:
In fact, using LINUX as a gateway (only as a gateway that can drive the entire local area of the INTERNET) is very simple, as long as you first connect (or dial) to the INTERNET, and then run the following two commands, (Of course, the root identity must be used ):
　　
Command 1:
# Echo 1>/proc/sys/net/ipv4/ip_forward
Note: Network Packet Forwarding (IPV4) is allowed)
　　
Command 2:
#/Sbin/ipchains-A forward-j MASQ-S xxx. xxx. xxx. xxx/32 description: xxx. xxx. xxx. xxx is the IP address of a machine in the LAN. this command allows xxx. xxx. xxx. camouflage of IP packet requests from xxx machines
　　
You can execute these two commands ...............
　　
Then, set the Gateway as the linux ip address in the TCP/IP attribute on the windows client ~
　　
But is there a security problem?