Configuring Linux ipchains with ICQ:

In order to be able to establish direct connections with ICQ clients behind a masquerading Linux machine, you need to set up some port forwardings. For ipchains this might prove a bit tricky in conjuction with dynamic IP addresses. This is because the forwarding rules include your current external IP address (unlike with iptables, so I'm told).

In order to make easy scripting possible, we need to be able to determine the current external IP address first. This can be done using the following script (assuming ppp0 is your connection to the internet) :

/usr/local/sbin/extip


		#!/bin/sh

		echo `/sbin/ifconfig ppp0 | grep 'inet addr' | awk '{print $2}' | sed -e 's/.*://'`

The second step is to make a script that will actually add the port forwardings (you will need the ipmasqadm package and ip_masq_portfw.o) :

/usr/local/sbin/conf_ipchains


		#/bin/sh



		#Paths to external programs

		IPMASQADM=/usr/sbin/ipmasqadm

		EXTIP=/usr/local/sbin/extip


		
		#Get external IP address once

		ip=`$EXTIP`


		
		# Clear current forwarding configuration

		$IPMASQADM portfw -f


		
		# Add port forwardings for ICQ for client on 192.168.0.2

		port=24500

		lastport=24505


		
		while [ "$port" -le "$lastport" ]

		do

				    $IPMASQADM portfw -a -P tcp -L $ip $port -R 192.168.0.2 $port

		            let "port=$port+1"

		done

You should run a test run of these scripts while connected to the internet, as shown below. Don't forget you need to chmod +x these files before you can run them.

The last part is to have the conf_ipchains script automatically executed when connecting to the internet. This can be done by editing the script /etc/ppp/ip-up. Some distributions (like my Debian) have a run-parts /etc/ppp/ip-up.d or similar last line in this script. If this is the case, you can just add a softlink to your conf_ipchains script in that directory:

On connecting, all the scripts in this directory will be executed in alphabetical order. The order probably doesn't matter much in most cases, but I added a '2' in the name anyway to make sure my script is executed right after the 1wwwoffle script in the example.

If your distribution doesn't have a /etc/ppp/ip-up.d directory and run-parts command in the ip-up script, you can just add the following line to the end of your if-up script and it should work:


		/usr/local/sbin/conf_ipchains

Additional notes:

You will need to adjust some of these scripts to match your configuration. Change the example IP address (192.168.0.2) and port numbers (24500 up to 24505) to your liking. Just repeat the same code several times if you have multiple clients, once for every IP. Make sure port ranges don't overlap.
If you use DHCP to assign IP addresses to your clients, you will have to add fixed leases for any IP adress you're forwarding to. This can be done in /etc/dhcpd.conf like this:
host marcel { hardware ethernet 00:50:04:F6:4D:64; fixed-address 192.168.0.2; }

Here 00:50:04:F6:4D:64 is the (unique) Mac Address of the client's Ethernet card. If the client currently has an IP address, you should be able to find it in /var/dhcp/dhcpd.leases.

Marcel Veldhuizen