Securing my real IP Address

Great Discussion on this subject:

http://www.experts-exchange.com/Networking/Q_20097488.html?query=IP+Maskarading&clearTAFilter=true

You have to have a routable internet ip from your ISP in order to be on the internt.  The device that takes that IP needs to be a gateway to your network.  I'm not sure you chould hide that IP.  You can give a firewall that live IP, and hide everyting inside the rotuer, but at some point, you have to have a visable IP.  The only way to have the gateway be the last demark point, in other words, is if you own that gateway and have control so you can put the nessacary routing infomation in it.

If your firewall supports a stealth mode, you might be able to stop software like whatmyip from finding it, but, the software at whatsmyip could not find you if you did not request a connection.  You allowed it to speak to your computer by the very fact that you connected to there site.  If somebody at that ip had tried to get a response from you without your requesting that connection first, it would have returned a null.  

I think this is what you were asking.

NAT and Inbound Port Forwarding - Some Address has to be made public as the remote host needs a return path(Your Address).

1)  I am not aware of being able to do this on a Linksys Router
2)  Even if it was possible, you would still have to get the gateway to forward all return request to the PC somehow..

This really doesn't have to do with your router.

You have two problems. First you are confusing _your_ computer's default gateway with your router's default gateway.

If your router's _real_ external IP address is 1.2.3.4 and your IP address is 192.168.0.10
and your router's _internal_ private IP is 192.168.0.1 then _your_ default gateway is 192.168.0.1, NOT whatever default gateway your ISP assigned your router.

So you really want the IP reporter (http://www.whatismyip.com/) to report your IP as 1.2.3.4 not as 192.168.0.1.

So, go to your router's web control panel, look in the status page and find it's real, external IP.
now browse to http://www.whatismyip.com/. It should report the same IP as the router's external IP. In my example above, that would be 1.2.3.4.

Now this SHOULD be the default behaviour for most router's and configurations. so if your routers IP _is_ being reported, then nothing is wrong.

If what http://www.whatismyip.com/ is reporting is your computer's internal private IP (192.168.0.10 in the example) then what's probably happening is your browser is ratting you out.
That is, it is possible for a website to use your browser to ask your system to report it's IP.
Though Firefox doesn't do this, at least by default.

I checked with my SuSE 9.3 Pro setup and Firefox, Konqueror, Opera, Mozilla, Epiphany, and Lynx all default to not reporting your IP.

Hope this helps clear it up.

Tachyon

Tachyon_1 gave a pretty good explanation (IMHO).

Unless your ISP is willing to do NAT, I am not aware you can do what you want.  In any event, even if they did do NAT for you, the IP address revealed will not be the "Default Gateway" but the IP on the far side of the router that's doing the NAT.

The key to understanding what's happeing is to do a diagram like the follwoing, and listing the near side (LAN) addresses and the far side addresses (WAN) of each routing device that moves traffic from one subnet to the next one.

Internet------(209.94.10.5)ISPGateway(66.245.195.1)------(66.245.195.189)DSLModemRouter(192.168.0.1)------(192.168.0.100)LinksysRouter(192.168.1.1)------(192..168.1.100)YourComputer#1

Source addresses as seen from a host out on the internet tend to be the WAN side IPs of the router, not the LAN Side.

An example of this is if you are able to do traceroutes (tracert in windows) from two computers to each other (that are separated by routers), you will see two different results.  Why, because going in one direction reports IPs on one side of each device (router) and the other direction will reveal IPs on the other side of the devices.

RG

Thanks ravindranathgoswami,

I agree, I think he is confused about what he or his teacher _thinks_ they are doing.

Even if you could somehow actually configure your setup in the manner that jslayton01 is actually asking, and I'm not sure you could, it wouldn't actually work IMO.

If hosts on the Internet believed your system to be at your gateway's address, no requests made to them would ever come back to you.

Example, you try to browse to google.com and your packets go out to google's server. These packets are then mangled by whatever magical process your instructor thinks he is using, and are sent out with a return address (or rather a source IP, but that's just semantics) that belongs to your ISP's gateway and NOT your computer. SO, what will happen is that google will receive the packets, process the request, and send it's response back to the gateway's ISP. When they reach the gateway, they will stop, and be dropped by the gateway, never reaching your computer.

The only thing that makes sense here is that your instructor has poorly explained his badly setup NAT router. And this would only work if he has decided to use real IP's on his LAN instead of properly using the assigned private IP's. (ie 192.168.x.x, or 10.x.x.x) This would explain why it looks like you are two gateway's deep.

I think this may be what you want is NAT.  If that's the case, just enable NAT and DHCP server on your router. Then, on your computer change your NIC settings to obtain an IP address via DHCP.

I know you are using SuSE, so just go to the YaST panel under network devices, pick your NIC at the bottom, choose edit, and pick DHCP settings (I'll explain that if you need me to). and reboot (I know I know, all you purists know you don't have too, and SuSE does reset the interface itself, but it's just easier and safer for a noob who's already used to rebooting Win and the drop of a hat)

What happens with NAT is this. When you send a packet out to the internet, it goes through your router first (which is _also_ your default gateway). The router mangles the packet and changes the source IP (or return address) from your computer's unrouteable private IP, to it's real Internet address. It also make a note to itself as to what computer sent that request, and to what server. Now when the response comes back from the Internet server, it's addressed to your router. The router looks at it and looks at it's little post-it-note and says, "ah ha, ok, that's that google request that jslayton01 sent" and forwards the return packet to your computer after changing the destination address to your computers private LAN IP address.

This accomplishes what you are asking. Your computer and it's IP are never exposed to the Internet. Your router (which is also your gateway, and hub, and firewall, and DHCP server, etc.) is exposed in your place.

So, thinking on it, I think you really just need NAT which was mis-explained to you by your instructor.

Let me know if you need walked through configuring your router and or computer for NAT.


Tachyon

Also, looking at your comments, I'm thinking you might have your DSL and router hooked up wrong.

IF you had your DSL modem plugged into one of your router's LAN ports instead of your WAN port, _and_ if you have DHCP on your DSL modem (or ISP) then it's possible that you could end up with the configuration you are saying you have. This would also explain why your computer shows up on the net with a real IP too.

Move the cable from the modem to the router's WAN or Internet port. Turn on the DHCP server in your router (first), and reboot the whole mess, DSL modem first, then router, then PC.

Tachyon

www.whatismyip.com works out the source address of the request, and uses that on a dynamic webpage.
If you change your source address, you'll change what is on this website...
No other way round it.
I don't think your instructor was doing what you think he was...

> Now, if I go into my router's configuration, what will I have to do in order to use the DEFAULT GATEWAY address instead of the INTERNET ADDRESS?
as explained above: don't do that 'cause it breaks your connection

jslayton01, before you ask more about your config and what you want to achieve: are you used to IP and RFC-IP (aka private IP) and NAT and what is a router
and a gateway (sorry in M$-terminology this seems to be the same)?
It's hard to give you instruction to do something which might be impossible or useless if your're not used to these terms.

> So if I want my default gateway to be shown on the net,
your default gateway (router) is never shown on the net!

-Ok, heres some more info on this: He is using a PRIVATE IP ADDRESS. Look below:

-Network Whois record

-Queried whois.arin.net with "!NET-69-227-102-8-1"..

-NetRange:   69.227.102.8 - 69.227.102.15
-CIDR:       69.227.102.8/29

^  This is a not a private address, it's a public address:
Private addresses are in these ranges:
Class A
(24 Bit) 10.0.0.0 10.255.255.255 /8 255.0.0.0
Class B
(20 Bit) 172.16.0.0  172.31.255.255 /12 255.240.0.0
Class C
(16 Bit)  192.168.0.0 192.168.255.255 /16  255.255.0.0

Private addresses are not routed over the internet, and that's why you cannot have one show up as the last IP to your network.  The last public IP will always be shown.

Right, you are confusing personal, owned or registered with private.
This means different things in TCP/IP terminology to what you might use in regular everyday speech.

Try thinking of it this way, a PRIVATE IP is kept private from the Internet. It never get's routed to the Internet, or replied to.
A PUBLIC IP is an IP that can be reached from and looked up on the Internet.

So even though you have your very own personal, one of a kind, your's only IP address. It's not a PRIVATE IP.
If you kept it private, it would be useless. Imagine if Google kept their IP 'private'? what good would it be? It's like having an unlisted phone number.
You're not gonna get a lot of calls to that.

As for
"So if I want my default gateway to be shown on the net, will I have to enable NAT in my router or not?"

You are misunderstanding that part. You are making a connection between your gateway and your Internet address because they happen to exist on the
same piece of hardware. Forget about your gateway address for now. Let's look at it.

Your Linksys router does multiple functions, it's a LAN hub, and WAN router, a gateway, a DHCP server, and firewall etc.

Your LinkSys exists on two networks. It has TWO IP addresses.
It is part of your Internal, private IP, LAN. By factory default, that IP address is 192.168.0.1 which is part of the network 192.168.0.0
It will assign clients on your LAN (like your PC) adresses via DHCP. You probably will be assigned something like 192.168.0.100
You LinkSys also is on the Internet and is assigned a real, PUBLIC IP by your ISP. That address appears to be 69.227.102.14.

Now, with NAT enabled on your LinkSys YOUR default gateway is 192.168.0.1 NOT 69.227.102.14
Your default gateway will always be part of the same subnet as you are (192.168.x.x in this case) that's why you NEED a gateway. A gateway is a router between
different subnets. In your case, between 192.168.x.x and the Internet.

So here's your setup:

                                               | -------------------- Linksys router box -----------------------------------  |
[PC at 192.168.0.100]--------------[linksys at 192.168.0.1]~~~~~~~~[linksys at 69.227.102.14]-----------<dsl modem>-----[the Internet]

--- = physical connection network connection                       ~~~ = internal virtual connection

Now, nothing from the Internet can go in past your LinkSys and access your LAN.


I still think, looking at your reported IP's that you have your DSL modem plugged into the wrong port on your LinkSys. Just because it works doesn't make it right.
IF you have your DSL modem plugged into the LAN ports, _it WILL still work_ however, you've turned your Linksys gateway, router, firewall into nothing more than a hub.
Because of this your PC is getting assigned a real public IP. At least that's what the ip you are reporting is. It's getting it's DHCP assignment from your ISP through the DSL modem, not through the router.

Do an 'ifconfig eth0' and see what it says for inet addr:

If it's really a real IP, then you do need to check your physical connections.

So, what you want is to see whatismyip.com to show your router's external IP address. Not your gateway address. Even though thats the same box.

If it reports the same IP as is reported by ifconfig above, then you have another problem alltogether.

Tachyon



 

No, you can't have a private IP address on the Internet. All routers are designed to drop all packets from private subnets when addressed to real subnets.

However, there are other options. Anonomizer sites and such. And you can google free proxy servers, though they don't often work well, or stay up long.
And if you're trying to hide from 'the man' forget it. You can't, not since the PA.

One solution is to use an ISP like US Family that double NAT's it's users. Personally I _hate_ this because you just plain can't get to your own box from the Internet at all.

I think you are worrying too much. If you have your router's default password changed, disable remote administration feature, run NAT, and don't forward any ports, you are really about as secure as you can be without hampering your functionality.

Glad to see your linux IP is a proper private one BTW. That's good. So your LAN/WAN is connected correctly.

I think you're fine. BTW, SuSE's pretty secure anyway, and it also has it's own firewall which can be enabled in YaST.

That and since you're not running Win/IE, you're already eliminating 99% of the security risk.

Tachyon

> As you can see, it shows my Routers IP address here.
As we all can see there is no router IP.
Please reread http:#14600200 (and all following comments).

> My main goal is, to have an anonymois IP which I thought I can use my 192.168.1.1 ip.
> Because no one can trace the 192.168.xxx Ip because many users are using it.
private IPs are not routed in the internet (again: see previous comments)
Also: if you hide/fake your IP, how should traffic come back?

>  So, is there any way that I can use an ANONYMOUS IP address?
no. Dot. Period.

> Is there like a free proxy server that I can use?
there're countless anonymizing proxies in the internet, just enter these keywords in your prefered search engine and you 10+k hits.
But take care which one you use, depending on in which country they are located, it's more or less anonymous.