gateway without nat

gateway without nat

[Lucio]

Hello everybody.

I need to setup a linux firewall with iptables with 3 NICs (LAN, WAN, DMZ). 
The LAN/WAN routing is no problem because I'm going to use NAT and a couple 
of rules to filter out the packets; so is the LAN/DMZ routing. However the 
computers that make up the DMZ are already in place (with an old firewall 
that's being substituted by the linux box), and they are already configured 
with their respective public ip addresses. What I need is a gateway for the 
DMZ that doesn't translate those public ip addresses, because I cannot modify 
the configurations of the computers in the DMZ to make them become 
192.168.whatever.youwant.
The problem is that I don't know how to make the kernel route packets between 
the DMZ and WAN NICs without using a SNAT rule: can anyone help me please?

Thanks in advance,
Lucio.

Re: gateway without nat

[Mohamed Eldesoky]

Bridge ??


On Thu, 7 Oct 2004 16:31:58 +0200, Lucio <lcml@pixel.it> wrote:
> Hello everybody.
> 
> I need to setup a linux firewall with iptables with 3 NICs (LAN, WAN, DMZ).
> The LAN/WAN routing is no problem because I'm going to use NAT and a couple
> of rules to filter out the packets; so is the LAN/DMZ routing. However the
> computers that make up the DMZ are already in place (with an old firewall
> that's being substituted by the linux box), and they are already configured
> with their respective public ip addresses. What I need is a gateway for the
> DMZ that doesn't translate those public ip addresses, because I cannot modify
> the configurations of the computers in the DMZ to make them become
> 192.168.whatever.youwant.
> The problem is that I don't know how to make the kernel route packets between
> the DMZ and WAN NICs without using a SNAT rule: can anyone help me please?
> 
> Thanks in advance,
> Lucio.
> 
> 


-- 
Mohamed Eldesoky
www.eldesoky.net
RHCE

Re: gateway without nat

[Cedric Blancher]

Le jeu 07/10/2004 à 16:31, Lucio a écrit :
> The problem is that I don't know how to make the kernel route packets between 
> the DMZ and WAN NICs without using a SNAT rule: can anyone help me please?

Maybe I don't get your point there, but to simply route packets, you
just have to do :

	echo 1 > /proc/sys/net/ipv4/ip_forward

And then set FORWARD chain rules accordingly to traffic you want to
allow. And that's it.


-- 
http://www.netexit.com/~sid/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
>> Hi! I'm your friendly neighbourhood signature virus.
>> Copy me to your signature file and help me spread!

Re: gateway without nat

[Jason Opperisano]

On Thu, 2004-10-07 at 10:31, Lucio wrote:
> Hello everybody.
> 
> I need to setup a linux firewall with iptables with 3 NICs (LAN, WAN, DMZ). 
> The LAN/WAN routing is no problem because I'm going to use NAT and a couple 
> of rules to filter out the packets; so is the LAN/DMZ routing. However the 
> computers that make up the DMZ are already in place (with an old firewall 
> that's being substituted by the linux box), and they are already configured 
> with their respective public ip addresses. What I need is a gateway for the 
> DMZ that doesn't translate those public ip addresses, because I cannot modify 
> the configurations of the computers in the DMZ to make them become 
> 192.168.whatever.youwant.
> The problem is that I don't know how to make the kernel route packets between 
> the DMZ and WAN NICs without using a SNAT rule: can anyone help me please?
> 
> Thanks in advance,
> Lucio.

are the WAN and DMZ subnets different?  if so--the answer to your
question, is to simply enable IP forwarding and make sure that the ISP
router is forwarding the DMZ subnet to the WAN IP of the firewall (which
i would assume is how it's working with the current firewall).

  sysctl -w net.ipv4.ip_forward=1

if your current firewall is doing some bridging--things get a bit more
interesting.

either way--you need to provide us more details.  your question is
unclear, or inane...i assume the former.

-j

-- 
Jason Opperisano <opie@817west.com>