gateway without nat
Hello everybody.
I need to setup a linux firewall with iptables with 3 NICs (LAN, WAN, DMZ). The LAN/WAN routing is no problem because I'm going to use NAT and a couple of rules to filter out the packets; so is the LAN/DMZ routing. However the computers that make up the DMZ are already in place (with an old firewall that's being substituted by the linux box), and they are already configured with their respective public ip addresses. What I need is a gateway for the DMZ that doesn't translate those public ip addresses, because I cannot modify the configurations of the computers in the DMZ to make them become 192.168.whatever.youwant.
The problem is that I don't know how to make the kernel route packets between the DMZ and WAN NICs without using a SNAT rule: can anyone help me please?
Thanks in advance,
Lucio.
Bridge ??
Quoted 18 lines · Lucio
Hello everybody.
I need to setup a linux firewall with iptables with 3 NICs (LAN, WAN, DMZ). The LAN/WAN routing is no problem because I'm going to use NAT and a couple of rules to filter out the packets; so is the LAN/DMZ routing. However the computers that make up the DMZ are already in place (with an old firewall that's being substituted by the linux box), and they are already configured with their respective public ip addresses. What I need is a gateway for the DMZ that doesn't translate those public ip addresses, because I cannot modify the configurations of the computers in the DMZ to make them become 192.168.whatever.youwant.
The problem is that I don't know how to make the kernel route packets between the DMZ and WAN NICs without using a SNAT rule: can anyone help me please?Thanks in advance,
Lucio.
Signature · 3 lines
Mohamed Eldesoky www.eldesoky.net RHCE
Quoted 2 lines · Lucio
The problem is that I don't know how to make the kernel route packets between the DMZ and WAN NICs without using a SNAT rule: can anyone help me please?
Maybe I don't get your point there, but to simply route packets, you just have to do :
echo 1 > /proc/sys/net/ipv4/ip_forward
And then set FORWARD chain rules accordingly to traffic you want to allow. And that's it.
Signature · 2 lines
http://www.netexit.com/~sid/ PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
Quoted 2 lines
Quoted 2 lines
Hi! I'm your friendly neighbourhood signature virus. Copy me to your signature file and help me spread!
Quoted 14 lines · Lucio
Hello everybody.
I need to setup a linux firewall with iptables with 3 NICs (LAN, WAN, DMZ). The LAN/WAN routing is no problem because I'm going to use NAT and a couple of rules to filter out the packets; so is the LAN/DMZ routing. However the computers that make up the DMZ are already in place (with an old firewall that's being substituted by the linux box), and they are already configured with their respective public ip addresses. What I need is a gateway for the DMZ that doesn't translate those public ip addresses, because I cannot modify the configurations of the computers in the DMZ to make them become 192.168.whatever.youwant.
The problem is that I don't know how to make the kernel route packets between the DMZ and WAN NICs without using a SNAT rule: can anyone help me please?
Quoted 2 lines
Thanks in advance,
Lucio.
are the WAN and DMZ subnets different? if so--the answer to your question, is to simply enable IP forwarding and make sure that the ISP router is forwarding the DMZ subnet to the WAN IP of the firewall (which i would assume is how it's working with the current firewall).
sysctl -w net.ipv4.ip_forward=1
if your current firewall is doing some bridging--things get a bit more interesting.
either way--you need to provide us more details. your question is unclear, or inane...i assume the former.
-j
Signature · 1 line
Jason Opperisano <[email protected]>