# The Guidedog Handbook

Simon
B.
Edwards

    simon@simonzone.com

2003
Simon B. Edwards
&FDLNotice;
11/11/2003
1.0.0

&guidedog; is an utility for configuring advanced Linux networking features such as IP Masquerade/Network Address Translation (NAT), and port forwarding.

KDE
linux
network
iptables
NAT
routing

## Introduction

&guidedog; is an utility for configuring some of the more advanced networking features of the Linux kernel, namely packet routing, IP Masquerade/Network Address Translation (NAT), and port forwarding.

This manual assumes a basic understanding of terms and concepts such as network protocols and IP addresses. The Guarddog documentation has a very quick explaination of IP address here. The How Stuff Works website also has good explaination of how the Internet works here.

### Firewall: Use one

&guidedog; is intended to be used in combination with a separate firewall program such as Guarddog. &guidedog; has the potential to expose your machine and networks to the broader Internet. This is why also using firewall is strongly recommended. Use &guidedog; to make set up your packet routing, and at the same time use your firewall to ensure that only the right people can access any newly exposed machine and networks.

### IP Masquerade Explained

IP Masquerade is also known as Network Address Translation (NAT) and Network Connection Sharing some other popular operating systems. It is basically a method for allowing a computer that doesn't have a public Internet wide IP address communicate with other computers on the Internet with the help of another computer sitting inbetween it and the Internet.

As you know IP address are used on the Internet to identify machines. Given a packet with an IP address, every router that makes up the Internet knows where to send that packet to get it to its destination. Now, there are also a few ranges of IP addresses that have been reserved for private use inside Local Area Networks and other networks that are not directly connected to the Internet. These private addresses are guaranteed not to be in use on the public Internet.

This causes problems for machines that are connected to private networks are use private IP addresses, because they can't be connected directly to the Internet. They don't have an IP address that is allowed to be used on the public Internet. IP Masquerade solves this problem by allowing a machine with a private IP address to communicate with the Internet, while at the same time modifying the machine's packets to use a valid public IP address instead of the original private IP address. Packets returning from the Internet are modified back to use the original IP address before reaching private IP machine.

IP Masquerade
IP Masquerade

In the diagram above all of the machines on the LAN are using the 192.168.1.x private IP address range. None of the these machines can communicate directly via the Internet. The machine running &guidedog; is acting as a gateway between the LAN and the Internet. It is a part of the LAN (192.168.1.1) and also has a public IP address (4.3.2.1). &guidedog; makes it possible for the machines in the LAN to communicate via the Internet, by performing IP Masquerade. Packets from machines on the LAN going to machines on the Internet, such as the packet from 192.168.1.3 destined for 5.6.7.8, are modified by &guidedog; to use the public IP address of the gateway (4.3.2.1). When packets from the Internet reach the gateway, &guidedog; and detect if they are actually intended for a machine inside the LAN. &guidedog; then modifies the packet to use the address from the LAN machine and then sends the packet on to its final destination.

It is important to note that &guidedog; needs to be running on the gateway machine, and all of the machines in the LAN need to be configured to use the gateway machine as the gateway for all packets destined for the Internet. Otherwise &guidedog; can't modify and send the packets to their destination on the Internet.

### Port Forwarding Explained

Port Forwarding is the technique of taking packets destined for a specific TCP of UDP port and machine, and 'forwards' them to a different port and/or machine. This is done 'transparently', meaning that network clients can not see that Port Forwarding is being done. They connect to a port on a machine when in actually fact the packets are being redirected elsewhere.

Just like IP Masquerade, when using Port Forwarding the packets that you wish to redirect need to pass through the machine running &guidedog;. If you are using Port Forwarding to forward a port on the &guidedog; machine to somewhere else, everything will work fine by default. The packets go directly to the &guidedog; machine and are then redirected/forwarded.

Port Forwarding
Port Forwarding

When using Port Forwarding it is important to keep in mind that &guidedog; can only modify packet traffic that passes through the computer running &guidedog;.

This is best explained by example. Looking at the diagram above, we have a couple machines (A and B) on a local area network. They are connected to the internet via a gateway (G). The gateway computer is also running &guidedog;. Imagine that we want to port forward traffic to TCP port 80 on machine G to port 80 on another computer on the internet (I). TCP port 80 is usually used by web servers incidently. Packets from the LAN (A and B) would go to port 80 on the gateway (G), and then &guidedog; would forward the packets on to their new destination, the machine (I) on the Internet. This would all work as expected.

What wouldn't work is if you tried to use &guidedog; to forward a port belonging to machine B. Packets passing through &guidedog; would be affected, but the port forward would not packets from machine A because machine A communicates with B directly without going through &guidedog; -- they are on the same local network.

This usually means that &guidedog; needs to run on a machine that is also acting as a gateway for the local network.

### Firewall Interaction

When IP Masquerade and Port Forwarding are in use it can be hard to know how exactly firewalls will react and how to correctly configure them. Here are some useful tips. These apply to the case where a firewall, such as Guarddog is running on the same machine as Guidedog.

- IP Masquerade is transparent to the firewall. Packets appear to the firewall in their original state with none of thier fields modified. Generally you don't have to worry about IP Masquerade, but systems that lie beyond the Guidedog machine will only see packets coming directly from the Guidedog machine and never from the computers that IP Masquerade is being used for.

- Port forwarding is applied before the firewall sees the packet. For example, if you are forwarding traffic for port 80 to port 8888, packets for port 80 will be modified to 8888 before being pasted to the firewall. The firewall will see 8888.

- Port forwarding also has the effect of applying a form of IP Maquerade to packets. Computers that lie beyond the Guidedog machine will see forwarded packets as coming from the Guidedog machine. A firewall on the Guidedog machine will see the original source IP though.

- The source IP addresses of packets are modified during IP Masquerade and Port Forwarding. You need to keep this in mind when using these features in combination with other server that use source IP address for authentication or even logging purposes. Most of the time the source IP address will always be the IP address of your Guidedog machine.

## Program Reference

### The Routing Tab

The Routing tab is concerned with routing packets between different machines.

Routing Tab
Screenshot of the Routing tab.

#### Routing

The Enable Routing checkbox controls whether your linux machine will even route packets at all. If this is checked then the Linux networking subsystem will try to route incoming packets on towards their destination. Features like IP Masquerade require routing to be turned on.

#### IP Masquerade

When Enable IP Masquerade is enabled, &guidedog; will automatically detect and masquerade packets coming from a private IP address and destined for a public Internet IP address.

Some network protocols don't work correctly with IP masquerade. For this reason there exists special support for a couple of the most common protocols, FTP (File Transfer Protocol) and IRC (Internet Relay Chat). Turning on Masquerade FTP or Masquerade IRC enabled this extra support.

#### No-masquerade Addresses

No-masquerade Addresses are destination IP addresses that can and should be contacted without applying IP masquerade to the packets. Generally this feature does not need to be used often, but there are situations where it is necessary in connection with VPN (Virtual Private Networks) and other exotic routing configurations.

The list of No-masquerade addresses appears in the middle of the window. A new IP address can be added using the New Address button. No-masquerade Addresses. The currently selected IP address can be edited in the Address: editbox. The Delete Address button deletes the selected address.

### The Forwarding Tab

The Forwarding Tab is where "port forwards" can be setup.

Forwarding Tab
Screenshot of the Forwarding tab.

Port Forwarding Rules: is the list of existing forwarding rules. A new rule can be created with the New Rule button. The currently selected rule can be deleted with the Delete Rule button. The currently selected rule is highlighted and shown below in the Original Destination and New Destination areas.

#### Original Destination

This section specifies which port should be redirected and forwarded to the new destination. Port: specifies which port and protocol should be forwarded. The protocol is either TCP of UDP and the port is in the range 0 to 65535.

IP Address: specifies which IP address the forwarding rule applies to. The forwarding rule is only applied when a packet's destination IP address, port and protocol match. Normally the destination IP address is just one belonging to the machine that &guidedog; is running on. By specifying a different IP address in the Specify: field, &guidedog; can also redirect and forward packets that are not actually destined for the current machine. But only if the packets are routed through the &guidedog; machine.

#### New Destination

This section specifies where forwarded packets should be redirected to.

Port: in the New Destination box specifies the new destination port for any packets that match this forwarding rule.

Packets can be redirected to current machine or to another IP address using the IP Address: radio-buttons in the New Destination box, and the Specify: field.

#### Comment Field

Each forwarding rule can have a comment entered in the Comment: field. The comment is displayed in the Port Forwarding Rules: list and is just used to organise and label the rules.

### The Advanced Tab

&guidedog; can be disabled by turning the Disable Guidedog checkbox on, and clicking the Apply or Ok.

The Import/Export area is used to export or import the current &guidedog; configuration to a file. The Description field can be used to enter a descriptive text about the current configuration. The current configuration can be exported to a file using the Export... button. While a &guidedog; configuration file can be imported and using the Import... button. Importing a configuration file will replace the current configuration.

## Credits and License

&guidedog;

Program copyright 2002-2003 Simon B. Edwards simon@simonzone.com

Documentation copyright 2003 Simon B. Edwards simon@simonzone.com

&underFDL;

&underGPL;

## Installation

### How to obtain Guidedog

&guidedog; is available for download at http://www.simonzone.com/software/guidedog/.

&documentation.index;