Possible to port forward ports automatically using masquerade?

Question

So I run a VPN business. When users want to port forward ports, I use DNAT.

Is it possible to make the ports automatically go open like upnp?

I've heard something that masquerade can do this.

Answer 1

Well, as you already named it, UPnP would do that. UPnP implementations for Linux which would modify iptables rules accordingly do exist but obviously UPnP needs applicaion support for the appropriate control requests. The Gentoo Wiki has a short howto for setting up linux-igd (the UPnP daemon implementation) to alter iptables rules.

As you might have noted, the important point about DNAT rules is to know where to DNAT to - the destination has to be explicitly stated. As there is no universal way to guess that, an automatic translation would be impossible unless you have found a different way of signaling the request - this is what UPnP is doing. A masquerade rule on the contrary is an SNAT-type rule, the address to use for the SNAT is determined by just taking the IP address of the outbound interface. Although this might be wrong for odd setups, for most use cases it works out quite fine.