Use iptables to set the bandwidth of a NAT shared network

Article title: use iptables to set the bandwidth of a NAT shared network. Linux is a technology channel of the IT lab in China. Includes basic categories such as desktop applications, Linux system management, kernel research, embedded systems, and open source.
Author: kenduest (Xiaozhou)
In Linux, what is the so-called IP address-Masquerade? Ransomed groups
　　
In Linux, IPMASQ has been adjusted to some core features of the kernel, so related configuration tools
Because different core versions are different.
　　
In the era of kernel 2.0.x, ipfwadm is used. (This statement is not completely correct)
　　
In the era of kernel 2.1.x/2.2.x, the ipchains program is used.
　　
In the era of kernel 2.3.x/2.4.x, netfilter is used to filter data.
Iptables program.
　　
According to the evolution, currently, kernel 2.4 works with the core filter mechanism of netfilter,
The functions that can be achieved are quite good... what mechanisms does netfilter provide?
For example:
　　
1. any functions of traditional ipchains (basic source and target packet filtering, orientation, and disguise)
2. provide Source NAT and Destination NAT functions
3. filtering and access of network connections can be restricted for specific users, groups, and PID.
4. you can set the packet to be pre-processed before the Routing Table goes in and out.
5. provide a function for the UserSpace program to process the filter part.
6. This type of online filtering processing can be automatically created outside and related to the existing online...
7. you can process Mac card numbers.
　　
What about ipmasq files? Linux itself provides enough howto...
　　
Use the kernel environment of ipfwadm/ipchains and other programs. for details, refer:
　　
Http://www.linux.org.tw/CLDP/IP-Masquerade-HOWTO.html
　　
However, the Chinese translation of this version of the file has not been updated for too long. we recommend that you find the original version.
IP-Masquerade-HOWTO file. Where can I find it? You can look for it here:
　　
Http://www.linuxdoc.org
　　
It contains important information such as port forward. For example
Ipmasqadm and other programs.
　　
If you are currently using kernel 2.3/2.4, refer to this article:
　　
Http://www.linux.org.tw/CLDP/NAT-HOWTO.html
　　
Http://www.linux.org.tw/CLDP/Packet...ring-HOWTO.html
　　
The same, the original part, on the http://www.linuxdoc.org also has oh ..
　　
Of course, if your linux dist version is recent, the system is installed properly.
The HOWTO file can also be found ..
　　
OK .. if you want to use the nat function now, first determine that your core is to support
Linux firewall and ip masquerade functions...
Distribution has integrated IP Masquerade support into the kernel,
So the part of the re-compile kernel can be skipped ....
　　
Of course, it is not long before the official release of kernel 2.4.0.
If you want to use some advanced mechanisms provided by netfilter, you need to update them first.
Core to 2.4. when compiling the core, you must enable some functions provided by netfilter ..
(You can choose to compile it into the core or compile it into a module)
　　
The environment here is assumed to be:
　　
The ip address connected to the internet is 210.1.1.1.
For the internal part, use 192.168.1.1
　　
Of course, you need two network cards, one is set to 210.1.1.1, and the other
Is to set 192.168.1.1 (netmask: 255.255.255.0)
　　
Some people may say that ip aliases can be used to access a network card.
You can have two ip addresses. of course, this is feasible.
In a nat environment, most nat servers act as firewall.
If the ip address aliases is used, both the external and internal packets run on the same interface
The packet filtering function is lost, and packets in different segments run together, the network
Performance also gets worse...
　　
OK... if you want to activate the nat/ipmasq function, you need
Enable IP Forwarding (ip Forwarding) and use ipchains, iptables, and other such programs.
After setting, the Client can access the Internet with the help of the Linux gateway host.
　　
Kernel 2.2.x:
　　
Echo "1">/proc/sys/net/ipv4/ip_forward
Ipchains-P forward DENY
Ipchains-A forward-I eth0-j MASQ-s 192.168.1.0/24
Ipchains-M-S 86400 86400 360 <-- this makes timeout a little longer
Modprobe ip_masq_ftp <-- Mount a module such as ftp to handle ftp-related connection problems
　　
Of course, I think some other ipmasq modules may be more complete...
　　
Ip_masq_cuseeme, ip_masq_irc, ip_masq_mfw, ip_masq_pptp,
Ip_masq_quake, ip_masq_raudio, ip_masq_user, ip_masq_vdolive ..
　　
Kernel 2.3.x/2.4.x:
　　
Echo "1">/proc/sys/net/ipv4/ip_forward
Modprobe ip_tables # This is required only when the module is selected as the core of compilation.
Modprobe ip_nat_ftp # Same as above, handling ftp and other connection issues
Modprobe ip_conntrack
Modprobe ip_conntrack_ftp
Modprobn ip_conntrack_irc
Iptables-t nat-a postrouting-o eth0-s 192.168.1.0/24-j MASQUERADE
　　
For the above usage, please note that each INPUT, OUTPUT, and FORWARD CHAIN
Is it ACCEPT, not DROP/DENY or REJECT.
　　
For kernel 2.2:
　　
Ipchains-P input ACCEPT
Ipchains-P output ACCEPT
Ipchains-P forward ACCEPT
　　
If you want to clear rules, you can add:
　　
Ipchains-F
Ipchains-X
　　
For kernel 2.4:
　　
Iptables-P INPUT ACCEPT
Iptables-P OUTPUT ACCEPT
Iptables-P FORWARD ACCEPT
　　
If you want to clear rules, you can add:
　　
Iptables-F
Iptables-X
Iptables-F-t nat
Iptables-X-t nat
　　
The above provides nat/ipmasq services with no security considerations, for example
If the ip address range from the internal network is entered by the external interface eth0
This should be rejected... for example, if it is located in the virtual ip segment 192.168.1.x on eth1
Is an example. So what I want to talk about here is that, if we want to be more rigorous, additional settings are quite necessary...
　　
In addition, port forward is used in kernel 2.2.x.
Ipmasqadm:
　　
Ipmasqadm portfw-a-P tcp-L 210.1.1.1 25-R 192.168.1.100 25
　　
This ipmasqadm describes how to enable nat to be used by external hosts.
210.1.1.1 port 25 is used for tcp service connection, and the connection request is forwarded to the internal host
192.168.1.100 port 25... simply put, this line of description is to give a mail server
Is to use virtual ip addresses in the nat architecture, and then set port re-import through the nat host
To the internal Real host.
　　
If kernel 2.4 is used, the iptables command is:
　　
Iptables-a prerouting-t nat-p tcp-d 210.1.1.1 \
-- Dport 25-j DNAT -- to 192.168.1.100: 25
　　
Of course, it was previously mentioned that the use of telnet 210.1.1.1 25 outside can indeed work,
However, if the internal computer 192.168.1.x is telnet 210.1.1.1 25, it will not work ..
Add the following description:
　　
Iptables-a output-t nat-p tcp-d 210.1.1.1 \
-- Dport 25-j DNAT -- to 192.168.1.100: 25
　　
The above is a single port re-import .. if the required function is all port
For example, you can use the following code to re-import a data file:
　　
Iptables-a prerouting-t nat-p all-d 210.1.1.1 \
-J DNAT -- to 192.168.1.1
　　
OK .. in addition, it should be noted that:
　　
1. many people currently use adsl broadband. if you use a time-based system, note that,
This is because a ppp0 interface is generated after a program such as pppoe is called,
Then, the packets are transmitted through a network card interface, so the previous commands have specified
The description of eth0 must be changed to ppp0 to be correct ....
　　
2. after using nat, use a virtual ip address to connect to a computer on the network.
It will not be a problem... but if you want to connect to a computer on the internet
Some problems may occur in game battles... because many games are online.
In the nat architecture, most of them cannot work.
Whether a module of ipmasq has been written by a specialist. after being mounted, it can be solved...
Or find the related game that has links to those ports, and then set the port
Forwarding action.
　　
For the port forwarding section, there is a link to provide good information:
　　
Http://www.tsmservices.com/masq
　　
Many ap programs, game programs, and so on provide related solutions.
Use ipmasqadm program in kernel 2.2.x.
After studying the usage of the iptables command, it can also be done.
　　
3. can someone use icq to transfer files or even send messages correctly? I suggest updating
Icq to 2000 and other versions, and then change the link settings to be behind firewall
Use, then there is no problem...
　　
4. to observe the current rules, use iptables-L. If-t xxxx is used at the beginning
Use iptables-L-t xxx. Ex: iptables-L-t nat
　　
5. Previous netfilter core mechanisms had some bugs (Connection State, Related state
Bug) may cause some security issues, see:
　　
Http://www.tempest.com.br/advisories/01-2001.html
　　
Http://netfilter.samba.org/secu