IP Masquerading - is it just for email?

Question

For some reason I thought it was a security feature of Ubuntu. Is there anything security related pertaining to it?

Answer 1

IP Masquerade is a security feature for this reason: In the general case, any machine whose IP address is being masqueraded by a firewall or router is not reachable from the public internet. If you have one firewall box running IP Masquerade with fifteen client PCs behind it, using that box as the path to the Internet, then no Internet host can directly create a new IP connection to any of those fifteen boxes. The fifteen client PCs can create outbound connections to the Internet, but no-one on the Internet can directly connect to one of those PCs.

It's called "Masquerade" because to the outside world, it looks like there is only one computer with a larger number of users. That is, a user connecting to Google via IP Masquerade will appear -- to Google -- to be coming from the Masquerading box.

By itself, IP Masquerade protects against a wide set of attacks. However, there are many attacks it does not protect against at all, such as Trojans or against another PC on the local LAN that is hacked. IP Masquerade is often useful as one component of a larger security plan.

Answer 2

IP Masq is one of the forms of Network Address Translation (NAT). It is NAT that allows you to use 192.168.0.0/16 addresses in your home or business while only having one or a few actual routable IP addresses. It's fundamental to how the IPv4 Internet works now. All consumer grade home routers support this, and the Linux kernel has supported it for a very long time now (possibly as far back as the 1.3 kernels)

As for its role as a security feature, there is still some debate about that. The PCI-DSS standards (credit-card industry) require its usage so in that case it is perceived as a security feature.

Answer 3

IP masquerading is what let you share a public ip address to many computers in a network. All routers typically do this by default between WAN and LAN ports.

In Linux it is done with Netfilter system managed by iptables command. This system also manages firewall filter rules (eg: block incoming traffic to port 80), which are indeed more related to security.

http://tldp.org/HOWTO/IP-Masquerade-HOWTO/ipmasq-background2.1.html

Answer 4

IP Masqerade is NOT for email. Other than for your ISP's email relay many servers will refuse to accept your email. Incoming email doesn't work with IP Masqerage, although you can use email clients to connect to a POP or IMAP server. You can run an email server either on the server doing the Masquerading, or use DNAT (Destination Network Address Translation) to forward to a single internal email server for each external address.

IP Masqerade is a form of SNAT (Source Network Address Translation). This works as a security feature as it forces a defauly deny policy from the Internet or other outside network. IP Masquerade provide no incoming routes to the servers which are being masqueraded. This protects against access vectors that use incoming connection. Any incoming access needs to be configured as a DNAT rule or an exception though a protocol helper as is used to allow full FTP funtionality.

IP Masquerade is typically used to enable the use of private DNS zone on the Local Area Network, while allowing access to the Internet. These are usually in the 192.168.0.0/16 and the 10.0.0.0/8 blocks, but also includes the 172.16.0.0/12 block. IP Masquade will work for other blocks, but this should only be done during transition to private blocks. The private ranges provide some security as they should not be routable on the external interface of any border switches.

IP Masquerade should be combined with appropriate firewall rules to limit the protocols used to access the Internet.