set up my DMZ
I've a DMZ with two server, I would like to acces them through my iptables firewall.
IP_serve1_DMZ =192.168.2.2IP_serve2_DMZ =192.168.2.3
IP_server1_public = x.x.x.52IP_server2_public = x.x.x.53 (x is for privacy..)
My firewall has
eth1 internet interface = x.x.x.50 eth0 dmz interface = 192.168.2.1
I need to have my server access with their pubbic IP, but I've only eth1 as inteface to internet.
I read that I can't use alias in iptables rules (like eth1:1 etc) , then what kind of rules have I to write to solve my problem?
Thanks
_______________________________________
Connessione ed e-mail gratuita da 10 mb consultabile tramite web e tramite pop. www.infinito.it vieni a scoprire tutti i nostri servizi!
Quoted 15 lines · On Thu, 2004-09-16 at 10:44, [email protected] wrote:
I've a DMZ with two server, I would like to acces them through my iptables firewall.
IP_serve1_DMZ=192.168.2.2IP_serve2_DMZ=192.168.2.3
IP_server1_public= x.x.x.52IP_server2_public= x.x.x.53 (x is for privacy..)My firewall has
eth1 internet interface = x.x.x.50
eth0 dmz interface = 192.168.2.1
Quoted 6 lines
I need to have my server access with their pubbic IP, but I've only eth1 as inteface to internet.
I read that I can't use alias in iptables rules (like eth1:1 etc) , then what kind of rules have I to write to solve my problem?
<snip>
If I understand you correctly, simple NAT should be your answer.
iptables -t nat -A PREROUTING -d x.x.x.52 -j DNAT --to-destination 192.168.2.2 (optionally add -i eth1 to thematch if you do are not using split DNS for any internal neworks)
You will also need filter table rules to explicitly allow the DNAT'd traffic to pass.
Signature · 9 lines
John A. Sullivan III Chief Technology Officer Nexus Management +1 207-985-7880 [email protected] --- If you are interested in helping to develop a GPL enterprise class VPN/Firewall/Security device management console, please visit http://iscs.sourceforge.net
Quoted 15 lines · On Thu, 2004-09-16 at 10:44, [email protected] wrote:
I've a DMZ with two server, I would like to acces them through my iptables firewall.
IP_serve1_DMZ=192.168.2.2IP_serve2_DMZ=192.168.2.3
IP_server1_public= x.x.x.52IP_server2_public= x.x.x.53 (x is for privacy..)My firewall has
eth1 internet interface = x.x.x.50
eth0 dmz interface = 192.168.2.1
Quoted 6 lines
I need to have my server access with their pubbic IP, but I've only eth1 as inteface to internet.
I read that I can't use alias in iptables rules (like eth1:1 etc) , then what kind of rules have I to write to solve my problem?
ip address add x.x.x.52 dev eth1
ip address add x.x.x.53 dev eth1
iptables -t nat -A PREROUTING -i eth1 -d x.x.x.52 \
-j DNAT --to-destination 192.168.2.2
iptables -t nat -A PREROUTING -i eth1 -d x.x.x.53 \
-j DNAT --to-destination 192.168.2.3filter rules as necessary (remember to use the 192.168.2.x address in your filter rules)...
HTH...
-j
Signature · 1 line
Jason Opperisano <[email protected]>
A message that is not in the archive (sent off-list or not yet received): [email protected]
---------- Forwarded message ----------
From: Mohamed Eldesoky <[email protected]>
Date: Sun, 19 Sep 2004 11:12:13 +0300
Subject: Re: set up my DMZ
To: Jason Opperisano <[email protected]>
Quoted 19 lines · Jason Opperisano
Quoted 18 lines · On Thu, 2004-09-16 at 10:44, [email protected] wrote:
I've a DMZ with two server, I would like to acces them through my iptables firewall.
IP_serve1_DMZ=192.168.2.2IP_serve2_DMZ=192.168.2.3
IP_server1_public= x.x.x.52IP_server2_public= x.x.x.53 (x is for privacy..)My firewall has
eth1 internet interface = x.x.x.50
eth0 dmz interface = 192.168.2.1I need to have my server access with their pubbic IP, but I've only eth1 as inteface to internet.
Quoted 7 lines
Quoted 3 lines
I read that I can't use alias in iptables rules (like eth1:1 etc) , then what kind of rules have I to write to solve my problem?
ip address add x.x.x.52 dev eth1
ip address add x.x.x.53 dev eth1
He really needs to do this step ????
The firewall is his gateway !!
Quoted 4 lines
--
Jason Opperisano <[email protected]>
--
Mohamed Eldesoky
www.eldesoky.net
RHCE
Signature · 3 lines
Mohamed Eldesoky www.eldesoky.net RHCE
Quoted 6 lines · Mohamed Eldesoky
Quoted 3 lines
ip address add x.x.x.52 dev eth1
ip address add x.x.x.53 dev eth1He really needs to do this step ????
The firewall is his gateway !!
yes. he does. the firewall is his gateway on the inside/dmz. these IP aliases are on the outside, internet-facing interface.
-j
Signature · 1 line
Jason Opperisano <[email protected]>