firehol-masquerade - set up masquerading (NAT) on an interface
masquerade real-interface rule-params
masquerade [reverse] rule-params
The masquerade helper command sets up masquerading on the output of a real
network interface (as opposed to a FireHOL interface definition).
If a real-interface
is specified the command should be used before any
interface or router definitions. Multiple values can be given separated by
whitespace, so long as they are enclosed in quotes.
If used within an interface definition the definition's real-interface
will be used.
If used within a router definition the definition's outface(s) will be used, if
specified. If the reverse option is given, then the definition's inface(s)
will be used, if specified.
Unlike most commands, masquerade does not inherit its parent definition's
, it only honours its own. The inface and outface parameters
should not be used (iptables(8) does not support inface in the POSTROUTING
chain and outface will be overwritten by FireHOL using the rules above).
The masquerade always applies to the output of the chosen network interfaces.
FIREHOL_NAT will be turned on automatically (see firehol-defaults.conf(5) ) and
FireHOL will enable packet-forwarding in the kernel.
Masquerading is a special form of Source NAT (SNAT) that changes the source of
requests when they go out and replaces their original source when they come
in. This way a Linux host can become an Internet router for a LAN of clients
having unroutable IP addresses. Masquerading takes care to re-map IP addresses
and ports as required.
Masquerading is expensive compare to SNAT because it checks the IP address of
the outgoing interface every time for every packet. If your host has a static
IP address you should generally prefer SNAT.
# Before any interface or router
masquerade eth0 src 192.0.2.0/24 dst not 192.0.2.0/24
# In an interface definition to masquerade the output of its real-interface
# In a router definition to masquerade the output of its outface
# In a router definition to masquerade the output of its inface
- firehol(1) - FireHOL program
- firehol.conf(5) - FireHOL configuration
- firehol-interface(5) - interface definition
- firehol-router(5) - router definition
- firehol-params(5) - optional rule parameters
- firehol-nat(5) - nat, snat, dnat, redirect config
- FireHOL Website (http://firehol.org/)
- FireHOL Online PDF Manual
- FireHOL Online Documentation