Re: Routing Public IPs over NAT Address Space

[Shawn <core@enodev.com>]

To follow up on a private reply, it can be troublesome to have NAT
gateways in between the big "I" and customers anyway.

I think what you're saying is you want your linux router to forward
public subnets to private subnets over at some customer site. Problem
is, if they want to administer their own DNS, they have to figure out
how to correctly configure DNS views, so internal resolvers don't
resolve to external addresses, etc etc. BIG TROUBLE!!!

I suggest simply routing whatever public traffic, or, in addition to
that, implement an MPLS infrastructure if you/they care about privacy.

On Mon, 2003-07-14 at 17:10, A. Clausen wrote:
> ----- Original Message ----- 
> From: "Shawn" <core@enodev.com>
> To: <techlists@alberni.net>
> Cc: "Netfilter Mailing List" <netfilter@lists.netfilter.org>
> Sent: Monday, July 14, 2003 13:23
> Subject: Re: Routing Public IPs over NAT Address Space
> 
> 
> > Please describe precisely, what you want to accomplish. An example:
> >
> > I would like for hosts out on the public internet to be able to connect
> > to my nnn.nnn.nnn.0/24 through my router, whose internet facing
> > interface is responsible for routing said nnn.nnn.nnn.0/24, but where
> > nnn.nnn.nnn.0/24 lies across some 10.0.0.0/24 which is "directly
> > connected" to the other interface of said router.
> >
> > There are folks out there that would like to help you, but if you can't
> > be bothered to take the time to describe your question with enough
> > specificity (and with correct terms), no one can help.
> 
> Sorry about that.  I'll be more specific.
> 
> I work for a small ISP, and we are selling residential and business wireless
> service.  Thus far, using iptables NAT, we've had no problems.  It works
> well and permits MSN Messenger and the like to work.  For those people who
> want a public IP, I simply do forwarding, and this works very well.
> 
> However, we've had some inquiries about a few businesses who want actual
> subnets (for mail servers, web servers, or whatever).  The problem with NAT
> is that I can't guarantee there will be a helper for every protocol.  What I
> was wondering was whether I could allocate a subnet and get it across the
> private (NAT) network to their router.  I have my doubts as to whether this
> is possible, but not being an expert I thought I'd ask.
> 
> My thoughts are that VPN may be the way to go.