I have a lan with 15 computers in my the office, I want to acquire a 4 Mb/s ADSL and put a linux machine to do all the job of masquerading and forwarding of IP packages.

The thing is that the Internet Provider said that I can't do it, because the adsl service is only for one computer, like home use. (and that's why it is cheap, just $50 USD/month).

They also said that they can find out if I use more computers, and they will cut immediately the net.

I am quite sure they can't find out, but since they insisted, I came here to ask about.

By the way, I will use Jay's firewall script for the Internet sharing and firewall machine. It works just perfect, internet sharing, good firewall settings and easy to understand.

as long as you use a dns/dhcp server in your internal network when you masqurade your connection it should look like only one pc is connected. What im thinking is that they can "FIND OUT" by trying to access a web page on your router <- - most of the comercial routers do have a web based configuration interface. But as long as you block this they shouldent be able to tell.


Im not an expert on network stuff as far as being able to tear apart packets but they could find out if they seen that a packet was bound for another computer then the server ?

Other then that anything elese would be considered hacking the connection or breaking security by circumventing the firewall you setup. This would consitute hacking and is illieagal if its not specifyed that they can do this kind of montoring in your agreement.


Cox doesent like <-- (not enforced ) more connections then one computer on there network but i got something similar to what your doing setup at my house with a slackware server. Mostly they just tell us to disconnect it when we call them for support

One thing they can do is to monitor the TTL in a packet and if they see several different TTL's then they know there is more than one computer sending the packets.

I'd say use squid as a transparent proxy and try to limit access most of the machines to web stuff that can be proxied.

And a mail transfer agent (MTA) for mail on the gateway carrying squid. It's quite normal for a user to have several mail accounts, so that alone won't be a pointer. (I have something like 8 or 9 with 3 different domains.)

TTL monitoring really only works if the OSs in use all use different defaults, or if you have more than one tier of routing (i.e. some machines connected directly to the first router, then another router connected to that with yet more machines).

The most common ways to detect multiple machines behind NAT is to monitor IP IDs, TCP sequence numbers, and emphemeral source ports. Since most OSs increment these values in predictable ways, you'll know that there is more than one machine if you get some of the above numbers that have decremented instead of incremented.

OpenBSD takes care of this by having a packet filter feature for "modulate state" which randomizes all the applicable values. I'm not sure if iptables or one of the patch-o-matic modules supports something similar.

thanks for all the quick replies...

I plan to use dhcp server only.

I am researching about the TTL...

Be aware that even if it looks like your linux router is the only computer surfing you might give away your situation due to information sent within packets. For example ICQ would normally report both the local IP as well as the Public IP to your contacts. Having more than one computer using ICQ would show up in the icq traffic.