> Chain ppp0_masq (1 references)
> target prot opt source destination
> MASQUERADE all -- 192.168.1.0/24 anywhere
> MASQUERADE all -- 192.168.3.0/24 anywhere
> MASQUERADE all -- 169.254.0.0/16 anywhere
> --------------------------------------------
>
> As a matter of interest, is it possible
> to run a home network _without_ NAT?
>
> > If you would like a simple way out, you can consider
> > getting an inexpensive DSL/Cable router.
>
> Several people have suggested this,
> but I'm not sure why it is thought better than iptables on a computer.
> It seems to me that a router is a black box,
> and you're basically trusting software you know nothing about
> to only allow certain packets through.
> Isn't that slightly against the Linux philosophy?
>
1. The presence of the non-routable addresses (192.168.*.*)
does indicate the presense of NAT>
2. The DSL cable router is a simplied solution to the problem.
Iptables is a full featured firewall suitable for
business applications. You can devise vary intricate rules
to meet a host of needs. As a result the rule generation
is suitably full featured and therefore complex.
Using IPtables and 2 Nic cards you are using your Linux box
as your firewall router. A lot of people like to do it this
way. The downside is that if you turn your Linux box off for
whatever reason, you have disconnected your other computers
from the internet. The DSL/Cable routers usually have 4 or 8
RJ45 plugs for computers. Your Linux box is not required to
be on for the other computers to access the internet.
There are plenty of arguments for both ways of doing this.
3. If you are really hard core Linux, you can get an embedded Linux
that will run on a Linksys router. Then you can know all about
the software running on your router. I have never tried this
myself, but there is plenty of discussion on it in the newsgroups.
Bob Styma
