Re: [LARTC] Ip Src rewite.

[/dev/rob0 <rob0@gmx.co.uk>]

On Tuesday 2005-October-25 17:03, Daniel Frederiksen wrote:
> Well, yes my ISP has assigned me the two "classes", however the
> a.b.c.d/30 is a single IP through which the e.f.g.h/26 are routed
> through. The ISP is not routing the e.f.g.h/26 directly to the line,
> but through the single WAN IP a.b.c.e/30..
> This is why all traffic going through is touched and marked as coming
> from the WAN instead of the External IP address.

What you describe sounds like NAT. Your gateway should be forwarding 
that traffic with the source IP unchanged. Can you show us tcpdump or 
iptables -j LOG of some of these packets' source IP being changed?

I think we are missing part of the picture here. iptables-save; ip r l; 
ip ru l; ip a l # all those might help. Munge consistently if you feel 
compelled to munge.

> >>>>NB: Small diagram of the setup.
> >>>>
> >>>>  DMZ                     GW/FW           ISP/Internet
> >>>>-----------------------------------------------------------------
> >>>>------ Server #1  --|
> >>>>  e.f.g.h3/26  |
> >>>>
> >>>>               |---- Gateway/Firewall --- ISP  WAN IP: a.b.c.d/30
> >>>>
> >>>>  Server #2  --|      a.b.c.d1/30         Ext. IP: e.f.g.h/26
> >>>>  e.f.g.h4/26         e.f.g.h1/26

"DMZ" implies there is a separate subnet, and perhaps a SNAT'ed LAN, 
correct? You have 3 interfaces: internal, DMZ and external? Whether or 
not there is an internal doesn't directly affect this, but anyway, that 
is how I would set it up.

Your DMZ machines should have e.f.g.h1 as their default gateway. Your 
router machine should have whatever the ISP told you to use as its 
default gateway (probably a.b.c.d2, I bet.)
-- 
    mail to this address is discarded unless "/dev/rob0"
    or "not-spam" is in Subject: header
_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc