Oct 99 Online
Volume Number: 15
Issue Number: 10
Column Tag: MacTech Online
MacTech Online
by Jeff Clites <online@mactech.com>
Last month we started looking into some resources that can help you in setting up a
small network, such as a home network to connect a few computers and printers. We
found out that you can often cut your expenses by using an old Macintosh in place of
new dedicated hardware, in this case to let you network a non-network printer, or
expose a LocalTalk printer to an Ethernet network. Not only did we save some cash by
using an old Mac, but also we made it possible to print from Mac OS X Server on a Blue
and White G3, despite the limited connectivity options that platform currently
supports. This month we're going to see how to use a single IP address to connect
multiple machines to the outside world, again using an older Mac to do the real work.
Learning to Share: Network Address Translation
It's a pretty common problem - you only have one IP address available, but now you
have more than one computer. So, you have to decide which one gets to use the modem,
DSL line, or cable modem, or else you end up switching off and having to do a lot of
plugging and unplugging of cables. Although it seems as though it shouldn't be possible,
you actually can let all of your computers access the outside world at once through this
single public IP address, thanks to a protocol known as Network Address Translation
(NAT). In a nutshell, you assign arbitrary "private" IP addresses to the machines on
your local network, and all communication to the outside world goes through a gateway
machine (which can be a computer or a dedicated hardware device), which translates
the source address in the header of the outgoing packets to your single public IP
address, and it makes a note of this. Then, it reverses the process on incoming reply
packets, so that they arrive at the proper local machine.
NAT is a capability built into most firewall products, and there are hardware devices
which can act essentially as black boxes and do NAT for you, such as SonicWALL,
BeadleNet's firewall routers, and Macsense's XRouter. These devices tend to be simple
to set up and use, but are overkill if you just want to share an IP address - they are
designed to do much more than just NAT, and their prices reflect this. A
software-based approach is more economical, and it continues my theme of taking
advantage of your legacy Macs. Both Vicomsoft and Sustainable Softworks have software
solutions which perform NAT. Vicomsoft has several different products which include
this along with their other functionality, but I chose IPNetRouter from Sustainable
Softworks: there is no limit imposed on the number of computers you can connect
through a single gateway, and it is low-cost (it is priced at $89), in part because it is
simpler and a little more do-it-yourself. Also, there is a 50% educational discount
available. I'm going to focus on IPNetRouter here, but you may want to check out the
competition (both software- and hardware-based) for yourself.
SonicWALL
<http://www.sonicwall.com/>
BeadleNet
<http://www.beadlenet.com/>
Macsense XRouter
<http://www.macsensetech.com/Product/mih120.html>
Vicomsoft
<http://www.vicomsoft.com/>
Sustainable Softworks
<http://www.sustworks.com/>
Although IPNetRouter can seem a bit cryptic at first, if you just want to do NAT there
are clear instructions on the company's web site, and you'll be up and running in just
a few minutes. Your gateway machine can use either one or two Ethernet cards, and
there are instructions on how to set up either configuration. The two-card setup is
conceptually easier to understand, and offers a bit more security: one card connects to
your local network and the other connects to the outside, so no information about your
internal network configuration can leak to the outside world without going through
IPNetRouter. Ethernet cards are cheap, so you may want to opt for this setup.
Getting Started with IPNetRouter
<http://www.sustworks.com/products/ipnr/gettingstarted/Guide.html>
This brings up another benefit of NAT: your gateway machine acts in part as a firewall,
hiding your internal network from the outside world. In fact, from the outside it will
appear as though there is only a single computer involved. This, in itself, makes it
difficult to break into your internal computers; your private LAN can access the
public internet, but not the other way around. If you want to go a little further and add
some additional security measures, Sustainable Softworks has a page entitled Building
Your Own Low Cost Firewall which will help you set up IPNetRouter for this. Finally,
you can do almost the opposite, and "punch a hole" in your configuration to allow, for
instance, a web server to operate from inside of your network. To do this, you set up
IPNetRouter to do inbound port mapping, which routes all traffic destined for a
particular port at your public IP address to a particular port on a particular machine
on your internal network. This allows machines on the public internet to initiate
connections to your internal web server; they think they are connecting to, say, port
80 of your gateway machine, but really they are being served web pages from port 80
(or another port of your choosing) of in internal machine. You'll probably need to do
similar port mapping to use the QuickTime Streaming Server (but client machines can
receive streaming QuickTime 4 content without any special configuration - support
for this is built-in).
Building Your Own Low Cost Firewall
<http://www.sustworks.com/products/ipnr/gettingstarted/firewall.html>
Port Mapping
<http://www.sustworks.com/products/ipnr/gettingstarted/port_mapping.html>
So, for less than $90 I can connect multiple computers to the internet, and set up
firewall protection for a web server. That's not bad, and best of all, it's fast. In my
home setup, I'm using a PowerMac 7500/150 as my gateway, and there's no
noticeable slowdown compared to when my internal Mac is connected directly to my
DSL line. Part of the reason that IPNetRouter is fast is that it is Open Transport native
(in fact, most of its capabilities are built into Open Transport already, and
IPNetRouter just provides a way to configure them). But you also have to remember
that this isn't a computationally intensive task - I believe that Cisco routers still use
68K-based processors. So even an old 68K Mac should give pretty good performance.
The pages mentioned above do a pretty good job of introducing you to concepts such as
NAT, firewalls, and port mapping. You can get some more information on NAT from the
KnowledgeShare section of Vicomsoft's site, or you can go directly to the RFCs and get
the details.
Vicomsoft KnowledgeShare: Network Address Translation
<http://www.vicomsoft.com/knowledge/reference/nat.html>
RFC1631 - The IP Network Address Translator (NAT) <http://www.faqs.org/rfcs/rfc1631.html>
RFC2663 - IP Network Address Translator (NAT) Terminology and
Considerations
<http://www.faqs.org/rfcs/rfc2663.html>
So, again we've found a strategy that lets us use a spare Macintosh to save us the
expense of buying new hardware to set up our network, adding IP sharing to our bag of
tricks to go along with the printer sharing techniques we learned last month. Also,
we've again solved a problem that developers will be especially likely to face: even if
you plan to use only a single computer, if you are using Mac OS X Server then you
currently need a second IP address in order to access the internet from the Blue Box.
With a NAT setup this is no longer a problem, and you can use last month's printing
trick at the same time by running Apple's LocalTalk Bridge on your gateway along with
IPNetRouter - they seem to play well together.
As a final note, when you run into snags you should check out the Three Macs and a
Printer web site, which contains a wealth of information about setting up a small
network, and explains everything in simple terms. It covers many topics that I have
not been able to touch upon, and it has recently settled in to its very own domain.
Three Macs & a Printer
<http://www.threemacs.com/network/index.html>
When you get tired of connecting everything together, take a gander at the other links
available from the MacTech Online web pages at <http://www.mactech.com/online/>.