From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Ryan Beisner" Subject: WAP11: 1-to-1 NAT (DMZ) Date: Wed, 18 Sep 2002 17:59:54 -0500 Sender: netfilter-admin@lists.netfilter.org Message-ID: <003701c25f67$1a21fb20$64dc0a0a@dataarc> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0034_01C25F3D.31320280" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter@lists.netfilter.org This is a multi-part message in MIME format. ------=_NextPart_000_0034_01C25F3D.31320280 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable In Watchguard's Firebox system, there is a term called 1-to-1 NAT, a new = one to me. This is used in reference to a packet filtering router = protecting a DMZ from the WWW. Its principle is the same applied to = achieve my "virtual host." iptables -A PREROUTING -t nat -d 10.20.0.4 -j DNAT --to = 192.168.168.2 iptables -A POSTROUTING -t nat -d 192.168.168.2 -j SNAT --to = 10.20.0.4 Now I want to enable certain ports (for instance, 22 and 80) and deny = everything else. =20 When is the appropriate time to add protocol filters, before or after = these two lines? And what would they look like? 192.168.168.2 is a Linksys WAP11 behind the firewall 10.20.0.4 is a Virtual IP on the external interface (which is already = firewalled down the line). Thanks! -Ryan Beisner ------=_NextPart_000_0034_01C25F3D.31320280 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
In Watchguard's Firebox system, there = is a term=20 called 1-to-1 NAT, a new one to me.  This is used in reference to a = packet=20 filtering router protecting a DMZ from the WWW.  Its principle is = the same=20 applied to achieve my "virtual host."
 
        iptables=20 -A PREROUTING -t nat -d 10.20.0.4 -j DNAT --to=20 192.168.168.2
        iptables -A = POSTROUTING=20 -t nat -d 192.168.168.2 -j SNAT --to 10.20.0.4
 
Now I want to enable certain ports (for = instance,=20 22 and 80) and deny everything else. 
When is the appropriate time to add = protocol=20 filters, before or after these two lines?  And what would they look = like?
 
192.168.168.2 is a Linksys = WAP11 behind the=20 firewall
10.20.0.4 is a Virtual IP on the = external interface=20 (which is already firewalled down the line).
 
 
 
 
 
Thanks!
-Ryan = Beisner
------=_NextPart_000_0034_01C25F3D.31320280--