* Re: [LARTC] Ip Src rewite.
2005-10-25 12:36 [LARTC] Ip Src rewite Daniel Frederiksen
@ 2005-10-25 12:45 ` Oscar Mechanic
2005-10-25 12:58 ` Daniel Frederiksen
` (5 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: Oscar Mechanic @ 2005-10-25 12:45 UTC (permalink / raw)
To: lartc
Maybe I have missed somthing and you need to do it in POSTROUTING but
how about SNAT.
PS: ip can do stateless nat.
On Tue, 2005-
10-25 at 14:36 +0200, Daniel Frederiksen wrote:
> Hello folks..
>
> Does any of you know if it is possible to rewrite the ip src in a packet.
> I have a problem involving a DMZ with external IP addresses routed
> trough a single WAN IP. When the server initiates a connection, it looks
> like it comes from the WAN ip instead of it's designated External IP
> routed through the WAN.
> So in short, Is it possible to rewrite the packet in the router, with
> Iptables, to make it look like it comes from the external IP address
> instead of the WAN IP of the router/firewall.
>
> Thank you very much for your time, I appreciate it.
>
> /Daniel Frederiksen
>
>
> NB: Small diagram of the setup.
>
> DMZ GW/FW ISP/Internet
> -----------------------------------------------------------------------
> Server #1 --|
> e.f.g.h3/26 |
> |---- Gateway/Firewall --- ISP WAN IP: a.b.c.d/30
> Server #2 --| a.b.c.d1/30 Ext. IP: e.f.g.h/26
> e.f.g.h4/26 e.f.g.h1/26
> ----------------------------------------------------------------------
>
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [LARTC] Ip Src rewite.
2005-10-25 12:36 [LARTC] Ip Src rewite Daniel Frederiksen
2005-10-25 12:45 ` Oscar Mechanic
@ 2005-10-25 12:58 ` Daniel Frederiksen
2005-10-25 13:21 ` Oscar Mechanic
` (4 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: Daniel Frederiksen @ 2005-10-25 12:58 UTC (permalink / raw)
To: lartc
Oscar Mechanic wrote:
> Maybe I have missed somthing and you need to do it in POSTROUTING but
> how about SNAT.
>
Well currently I do not NAT at all. I have ip_forwarding enabled and
have assigned the first IP from the external block on the inside of the
Gateway/Firewall. On the outside of the Gateway/Firewall I have assigned
the WAN IP. This way when a system on the DMZ establishes a connection
it is forwarded through the Gateway.
Any suggestions to changes are appreciated.
/Daniel..
> PS: ip can do stateless nat.
>
> On Tue, 2005-
> 10-25 at 14:36 +0200, Daniel Frederiksen wrote:
>
>>Hello folks..
>>
>>Does any of you know if it is possible to rewrite the ip src in a packet.
>>I have a problem involving a DMZ with external IP addresses routed
>>trough a single WAN IP. When the server initiates a connection, it looks
>>like it comes from the WAN ip instead of it's designated External IP
>>routed through the WAN.
>>So in short, Is it possible to rewrite the packet in the router, with
>>Iptables, to make it look like it comes from the external IP address
>>instead of the WAN IP of the router/firewall.
>>
>>Thank you very much for your time, I appreciate it.
>>
>>/Daniel Frederiksen
>>
>>
>>NB: Small diagram of the setup.
>>
>> DMZ GW/FW ISP/Internet
>>-----------------------------------------------------------------------
>> Server #1 --|
>> e.f.g.h3/26 |
>> |---- Gateway/Firewall --- ISP WAN IP: a.b.c.d/30
>> Server #2 --| a.b.c.d1/30 Ext. IP: e.f.g.h/26
>> e.f.g.h4/26 e.f.g.h1/26
>>----------------------------------------------------------------------
>>
>>_______________________________________________
>>LARTC mailing list
>>LARTC@mailman.ds9a.nl
>>http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
>
>
_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [LARTC] Ip Src rewite.
2005-10-25 12:36 [LARTC] Ip Src rewite Daniel Frederiksen
2005-10-25 12:45 ` Oscar Mechanic
2005-10-25 12:58 ` Daniel Frederiksen
@ 2005-10-25 13:21 ` Oscar Mechanic
2005-10-25 13:25 ` Oscar Mechanic
` (3 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: Oscar Mechanic @ 2005-10-25 13:21 UTC (permalink / raw)
To: lartc
So you want packets leaving the WAN to have address e.f.g.h/26 rather
than a.b.c.d/30
That would mean you ISP has assigned you the two ranges e.f.g.h and
a.b.c.d.
Your gateway cannot be a gateway from this diagram
That must be e.f.g.h/27 GW has
e.f.g.h/27 and e.f.g.h/26 interfaces
> >> DMZ GW/FW ISP/Internet
> >>-----------------------------------------------------------------------
> >> Server #1 --|
> >> e.f.g.h3/26 |
> >> |---- Gateway/Firewall --- ISP WAN IP: a.b.c.d/30
> >> Server #2 --| a.b.c.d1/30 Ext. IP: e.f.g.h/26
> >> e.f.g.h4/26 e.f.g.h1/26
> >>----------------------------------------------------------------------
I would assume what you will end up doing is
iptables -t nat -A POSTROUTING -m mac-source <MACSERVER1> -j SNAT --to-
source <ALIAS1 of GW>
iptables -t nat -A POSTROUTING -m mac-source <MACSERVER2> -j SNAT --to-
source <ALIAS2 of GW>
Where ALIAS1 and ALIAS2 are the IP's of server 1 and server 2 aliased on
the firewall
Regards
Shane
On Tue, 2005-10-25 at 14:58 +0200, Daniel Frederiksen wrote:
> Oscar Mechanic wrote:
> > Maybe I have missed somthing and you need to do it in POSTROUTING but
> > how about SNAT.
> >
>
> Well currently I do not NAT at all. I have ip_forwarding enabled and
> have assigned the first IP from the external block on the inside of the
> Gateway/Firewall. On the outside of the Gateway/Firewall I have assigned
> the WAN IP. This way when a system on the DMZ establishes a connection
> it is forwarded through the Gateway.
>
> Any suggestions to changes are appreciated.
>
> /Daniel..
>
> > PS: ip can do stateless nat.
> >
> > On Tue, 2005-
> > 10-25 at 14:36 +0200, Daniel Frederiksen wrote:
> >
> >>Hello folks..
> >>
> >>Does any of you know if it is possible to rewrite the ip src in a packet.
> >>I have a problem involving a DMZ with external IP addresses routed
> >>trough a single WAN IP. When the server initiates a connection, it looks
> >>like it comes from the WAN ip instead of it's designated External IP
> >>routed through the WAN.
> >>So in short, Is it possible to rewrite the packet in the router, with
> >>Iptables, to make it look like it comes from the external IP address
> >>instead of the WAN IP of the router/firewall.
> >>
> >>Thank you very much for your time, I appreciate it.
> >>
> >>/Daniel Frederiksen
> >>
> >>
> >>NB: Small diagram of the setup.
> >>
> >> DMZ GW/FW ISP/Internet
> >>-----------------------------------------------------------------------
> >> Server #1 --|
> >> e.f.g.h3/26 |
> >> |---- Gateway/Firewall --- ISP WAN IP: a.b.c.d/30
> >> Server #2 --| a.b.c.d1/30 Ext. IP: e.f.g.h/26
> >> e.f.g.h4/26 e.f.g.h1/26
> >>----------------------------------------------------------------------
> >>
> >>_______________________________________________
> >>LARTC mailing list
> >>LARTC@mailman.ds9a.nl
> >>http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
> >
> >
>
>
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [LARTC] Ip Src rewite.
2005-10-25 12:36 [LARTC] Ip Src rewite Daniel Frederiksen
` (2 preceding siblings ...)
2005-10-25 13:21 ` Oscar Mechanic
@ 2005-10-25 13:25 ` Oscar Mechanic
2005-10-25 22:03 ` Daniel Frederiksen
` (2 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: Oscar Mechanic @ 2005-10-25 13:25 UTC (permalink / raw)
To: lartc
excuse my iptables
-m mac --mac-source 00:20:23:20:20:20
You will do this cause you dont want your 26 to become a 27 and loose 3
addrs.
Alias are no longer called aliases but for convenience
On Tue, 2005-10-25 at 14:21 +0100, Oscar Mechanic wrote:
> So you want packets leaving the WAN to have address e.f.g.h/26 rather
> than a.b.c.d/30
>
> That would mean you ISP has assigned you the two ranges e.f.g.h and
> a.b.c.d.
>
> Your gateway cannot be a gateway from this diagram
>
> That must be e.f.g.h/27 GW has
> e.f.g.h/27 and e.f.g.h/26 interfaces
> > >> DMZ GW/FW ISP/Internet
> > >>-----------------------------------------------------------------------
> > >> Server #1 --|
> > >> e.f.g.h3/26 |
> > >> |---- Gateway/Firewall --- ISP WAN IP: a.b.c.d/30
> > >> Server #2 --| a.b.c.d1/30 Ext. IP: e.f.g.h/26
> > >> e.f.g.h4/26 e.f.g.h1/26
> > >>----------------------------------------------------------------------
>
> I would assume what you will end up doing is
>
> iptables -t nat -A POSTROUTING -m mac-source <MACSERVER1> -j SNAT --to-
> source <ALIAS1 of GW>
> iptables -t nat -A POSTROUTING -m mac-source <MACSERVER2> -j SNAT --to-
> source <ALIAS2 of GW>
>
> Where ALIAS1 and ALIAS2 are the IP's of server 1 and server 2 aliased on
> the firewall
>
> Regards
> Shane
>
> On Tue, 2005-10-25 at 14:58 +0200, Daniel Frederiksen wrote:
> > Oscar Mechanic wrote:
> > > Maybe I have missed somthing and you need to do it in POSTROUTING but
> > > how about SNAT.
> > >
> >
> > Well currently I do not NAT at all. I have ip_forwarding enabled and
> > have assigned the first IP from the external block on the inside of the
> > Gateway/Firewall. On the outside of the Gateway/Firewall I have assigned
> > the WAN IP. This way when a system on the DMZ establishes a connection
> > it is forwarded through the Gateway.
> >
> > Any suggestions to changes are appreciated.
> >
> > /Daniel..
> >
> > > PS: ip can do stateless nat.
> > >
> > > On Tue, 2005-
> > > 10-25 at 14:36 +0200, Daniel Frederiksen wrote:
> > >
> > >>Hello folks..
> > >>
> > >>Does any of you know if it is possible to rewrite the ip src in a packet.
> > >>I have a problem involving a DMZ with external IP addresses routed
> > >>trough a single WAN IP. When the server initiates a connection, it looks
> > >>like it comes from the WAN ip instead of it's designated External IP
> > >>routed through the WAN.
> > >>So in short, Is it possible to rewrite the packet in the router, with
> > >>Iptables, to make it look like it comes from the external IP address
> > >>instead of the WAN IP of the router/firewall.
> > >>
> > >>Thank you very much for your time, I appreciate it.
> > >>
> > >>/Daniel Frederiksen
> > >>
> > >>
> > >>NB: Small diagram of the setup.
> > >>
> > >> DMZ GW/FW ISP/Internet
> > >>-----------------------------------------------------------------------
> > >> Server #1 --|
> > >> e.f.g.h3/26 |
> > >> |---- Gateway/Firewall --- ISP WAN IP: a.b.c.d/30
> > >> Server #2 --| a.b.c.d1/30 Ext. IP: e.f.g.h/26
> > >> e.f.g.h4/26 e.f.g.h1/26
> > >>----------------------------------------------------------------------
> > >>
> > >>_______________________________________________
> > >>LARTC mailing list
> > >>LARTC@mailman.ds9a.nl
> > >>http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
> > >
> > >
> >
> >
> > _______________________________________________
> > LARTC mailing list
> > LARTC@mailman.ds9a.nl
> > http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
>
> _______________________________________________
> LARTC mailing list
> LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [LARTC] Ip Src rewite.
2005-10-25 12:36 [LARTC] Ip Src rewite Daniel Frederiksen
` (3 preceding siblings ...)
2005-10-25 13:25 ` Oscar Mechanic
@ 2005-10-25 22:03 ` Daniel Frederiksen
2005-10-26 0:25 ` /dev/rob0
2005-10-26 1:20 ` Daniel Frederiksen
6 siblings, 0 replies; 8+ messages in thread
From: Daniel Frederiksen @ 2005-10-25 22:03 UTC (permalink / raw)
To: lartc
Oscar Mechanic wrote:
> So you want packets leaving the WAN to have address e.f.g.h/26 rather
> than a.b.c.d/30
>
> That would mean you ISP has assigned you the two ranges e.f.g.h and
> a.b.c.d.
Well, yes my ISP has assigned me the two "classes", however the
a.b.c.d/30 is a single IP through which the e.f.g.h/26 are routed
through. The ISP is not routing the e.f.g.h/26 directly to the line, but
through the single WAN IP a.b.c.e/30..
This is why all traffic going through is touched and marked as coming
from the WAN instead of the External IP address.
Any suggestions to solving that?.
/Daniel
>
> Your gateway cannot be a gateway from this diagram
>
> That must be e.f.g.h/27 GW has
> e.f.g.h/27 and e.f.g.h/26 interfaces
>
>>>> DMZ GW/FW ISP/Internet
>>>>-----------------------------------------------------------------------
>>>> Server #1 --|
>>>> e.f.g.h3/26 |
>>>> |---- Gateway/Firewall --- ISP WAN IP: a.b.c.d/30
>>>> Server #2 --| a.b.c.d1/30 Ext. IP: e.f.g.h/26
>>>> e.f.g.h4/26 e.f.g.h1/26
>>>>----------------------------------------------------------------------
>
>
> I would assume what you will end up doing is
>
> iptables -t nat -A POSTROUTING -m mac-source <MACSERVER1> -j SNAT --to-
> source <ALIAS1 of GW>
> iptables -t nat -A POSTROUTING -m mac-source <MACSERVER2> -j SNAT --to-
> source <ALIAS2 of GW>
>
> Where ALIAS1 and ALIAS2 are the IP's of server 1 and server 2 aliased on
> the firewall
>
> Regards
> Shane
>
> On Tue, 2005-10-25 at 14:58 +0200, Daniel Frederiksen wrote:
>
>>Oscar Mechanic wrote:
>>
>>>Maybe I have missed somthing and you need to do it in POSTROUTING but
>>>how about SNAT.
>>>
>>
>>Well currently I do not NAT at all. I have ip_forwarding enabled and
>>have assigned the first IP from the external block on the inside of the
>>Gateway/Firewall. On the outside of the Gateway/Firewall I have assigned
>>the WAN IP. This way when a system on the DMZ establishes a connection
>>it is forwarded through the Gateway.
>>
>>Any suggestions to changes are appreciated.
>>
>>/Daniel..
>>
>>
>>>PS: ip can do stateless nat.
>>>
>>>On Tue, 2005-
>>>10-25 at 14:36 +0200, Daniel Frederiksen wrote:
>>>
>>>
>>>>Hello folks..
>>>>
>>>>Does any of you know if it is possible to rewrite the ip src in a packet.
>>>>I have a problem involving a DMZ with external IP addresses routed
>>>>trough a single WAN IP. When the server initiates a connection, it looks
>>>>like it comes from the WAN ip instead of it's designated External IP
>>>>routed through the WAN.
>>>>So in short, Is it possible to rewrite the packet in the router, with
>>>>Iptables, to make it look like it comes from the external IP address
>>>>instead of the WAN IP of the router/firewall.
>>>>
>>>>Thank you very much for your time, I appreciate it.
>>>>
>>>>/Daniel Frederiksen
>>>>
>>>>
>>>>NB: Small diagram of the setup.
>>>>
>>>> DMZ GW/FW ISP/Internet
>>>>-----------------------------------------------------------------------
>>>> Server #1 --|
>>>> e.f.g.h3/26 |
>>>> |---- Gateway/Firewall --- ISP WAN IP: a.b.c.d/30
>>>> Server #2 --| a.b.c.d1/30 Ext. IP: e.f.g.h/26
>>>> e.f.g.h4/26 e.f.g.h1/26
>>>>----------------------------------------------------------------------
>>>>
>>>>_______________________________________________
>>>>LARTC mailing list
>>>>LARTC@mailman.ds9a.nl
>>>>http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
>>>
>>>
>>
>>_______________________________________________
>>LARTC mailing list
>>LARTC@mailman.ds9a.nl
>>http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
>
>
_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [LARTC] Ip Src rewite.
2005-10-25 12:36 [LARTC] Ip Src rewite Daniel Frederiksen
` (4 preceding siblings ...)
2005-10-25 22:03 ` Daniel Frederiksen
@ 2005-10-26 0:25 ` /dev/rob0
2005-10-26 1:20 ` Daniel Frederiksen
6 siblings, 0 replies; 8+ messages in thread
From: /dev/rob0 @ 2005-10-26 0:25 UTC (permalink / raw)
To: lartc
On Tuesday 2005-October-25 17:03, Daniel Frederiksen wrote:
> Well, yes my ISP has assigned me the two "classes", however the
> a.b.c.d/30 is a single IP through which the e.f.g.h/26 are routed
> through. The ISP is not routing the e.f.g.h/26 directly to the line,
> but through the single WAN IP a.b.c.e/30..
> This is why all traffic going through is touched and marked as coming
> from the WAN instead of the External IP address.
What you describe sounds like NAT. Your gateway should be forwarding
that traffic with the source IP unchanged. Can you show us tcpdump or
iptables -j LOG of some of these packets' source IP being changed?
I think we are missing part of the picture here. iptables-save; ip r l;
ip ru l; ip a l # all those might help. Munge consistently if you feel
compelled to munge.
> >>>>NB: Small diagram of the setup.
> >>>>
> >>>> DMZ GW/FW ISP/Internet
> >>>>-----------------------------------------------------------------
> >>>>------ Server #1 --|
> >>>> e.f.g.h3/26 |
> >>>>
> >>>> |---- Gateway/Firewall --- ISP WAN IP: a.b.c.d/30
> >>>>
> >>>> Server #2 --| a.b.c.d1/30 Ext. IP: e.f.g.h/26
> >>>> e.f.g.h4/26 e.f.g.h1/26
"DMZ" implies there is a separate subnet, and perhaps a SNAT'ed LAN,
correct? You have 3 interfaces: internal, DMZ and external? Whether or
not there is an internal doesn't directly affect this, but anyway, that
is how I would set it up.
Your DMZ machines should have e.f.g.h1 as their default gateway. Your
router machine should have whatever the ISP told you to use as its
default gateway (probably a.b.c.d2, I bet.)
--
mail to this address is discarded unless "/dev/rob0"
or "not-spam" is in Subject: header
_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [LARTC] Ip Src rewite.
2005-10-25 12:36 [LARTC] Ip Src rewite Daniel Frederiksen
` (5 preceding siblings ...)
2005-10-26 0:25 ` /dev/rob0
@ 2005-10-26 1:20 ` Daniel Frederiksen
6 siblings, 0 replies; 8+ messages in thread
From: Daniel Frederiksen @ 2005-10-26 1:20 UTC (permalink / raw)
To: lartc
/dev/rob0 wrote:
> On Tuesday 2005-October-25 17:03, Daniel Frederiksen wrote:
>
>>Well, yes my ISP has assigned me the two "classes", however the
>>a.b.c.d/30 is a single IP through which the e.f.g.h/26 are routed
>>through. The ISP is not routing the e.f.g.h/26 directly to the line,
>>but through the single WAN IP a.b.c.e/30..
>>This is why all traffic going through is touched and marked as coming
>>from the WAN instead of the External IP address.
>
>
> What you describe sounds like NAT. Your gateway should be forwarding
> that traffic with the source IP unchanged. Can you show us tcpdump or
> iptables -j LOG of some of these packets' source IP being changed?
I would like to supply some tcpdump data, but at the moment the amount
of data flowing through is massive and extends to 118 systems. I was
actually trying to simplify the scenario a little bit. The thing is I
also have multiple lines with the same config running through the
gateway/firewall as a multipath routed setup.
Ok here goes, I'll try to define the complete setup:
eth0 (WAN 1)
IP: 80.16x.xxx.70/30
eth1 (WAN 2)
IP: 80.16y.yyy.174/30
eth2 (Routed WAN 2 Class)
IP: 80.16z.zzz.65/26
eth3 (Routed WAN 1 Class)
IP: 62.24w.www.1/26
eth4
IP: 192.168.1.1/24
:~# ip ru
0: from all lookup local
32761: from 80.16x.xxx.70 lookup WAN1
32762: from 62.24w.www.0/26 lookup WAN1
32763: from 80.16z.zzz.64/26 lookup WAN2
32764: from 80.16y.yyy.174 lookup WAN2
32766: from all lookup main
32767: from all lookup default
:~# ip r
80.16y.yyy.172/30 dev eth1 proto kernel scope link src 80.16y.yyy.174
80.16x.xxx.68/30 dev eth0 proto kernel scope link src 80.16x.xxx.70
80.16z.zzz.64/26 dev eth2 proto kernel scope link src 80.16z.zzz.65
62.24w.www.0/26 dev eth3 proto kernel scope link src 62.24w.www.1
192.168.1.0/24 dev eth4 proto kernel scope link src 192.168.1.1
default via 80.16x.xxx.69 dev eth0
The only other settings are:
echo "1" > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to 80.16x.xxx.70
D'ooohhhh (Slaps his forehead)..
Just found the problem.. Missing a "-s 192.168.1.0/24" in the above
statement, to exclude everything except the LAN.. No wonder everything
got nat'ed..
Well, I guess I'm buying the next round..
Anyway, thanks allot guys. You made my day and night..
/Daniel.
>
> I think we are missing part of the picture here. iptables-save; ip r l;
> ip ru l; ip a l # all those might help. Munge consistently if you feel
> compelled to munge.
>
>
>>>>>>NB: Small diagram of the setup.
>>>>>>
>>>>>> DMZ GW/FW ISP/Internet
>>>>>>-----------------------------------------------------------------
>>>>>>------ Server #1 --|
>>>>>> e.f.g.h3/26 |
>>>>>>
>>>>>> |---- Gateway/Firewall --- ISP WAN IP: a.b.c.d/30
>>>>>>
>>>>>> Server #2 --| a.b.c.d1/30 Ext. IP: e.f.g.h/26
>>>>>> e.f.g.h4/26 e.f.g.h1/26
>
>
> "DMZ" implies there is a separate subnet, and perhaps a SNAT'ed LAN,
> correct? You have 3 interfaces: internal, DMZ and external? Whether or
> not there is an internal doesn't directly affect this, but anyway, that
> is how I would set it up.
>
> Your DMZ machines should have e.f.g.h1 as their default gateway. Your
> router machine should have whatever the ISP told you to use as its
> default gateway (probably a.b.c.d2, I bet.)
_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
^ permalink raw reply [flat|nested] 8+ messages in thread