SV: [LARTC] Packet rewriting

* SV: [LARTC] Packet rewriting
@ 2000-10-25 14:42 Daniel
  2000-10-25 16:34 ` Daniel
  0 siblings, 1 reply; 2+ messages in thread
From: Daniel @ 2000-10-25 14:42 UTC (permalink / raw)
  To: lartc

<PRE>I'm not sure of what you want but here is an example:
(Assuming local net is 10.0.0.160/27)

# Accept icmp (for example ping)
ipchains -A output -p icmp -j ACCEPT

# Deny TCP sessions to local network (that is noone outside
# the firewall may access web, ftp,... at your local net)
# (Note the -y option)
ipchains -A output -p tcp -d 10.0.0.160/27 -y -j DENY

# Accept any TCP packets to local network
ipchains -A output -p tcp -d 10.0.0.160/27 -j ACCEPT

# Maybe you want some UDP ports open
# Accept port 4000/UDP to local network
ipchains -A output -p udp -d 10.0.0.160/27 4000 -j ACCEPT

# Deny anything else to local network
ipchains -A output -d 10.0.0.160/27 -j DENY

Regards,
Daniel

&gt; -----Ursprungligt meddelande-----
&gt; Från: <A HREF="mailto:lartc-admin@mailman.ds9a.nl">lartc-admin@mailman.ds9a.nl</A>
&gt; [mailto:<A HREF="mailto:lartc-admin@mailman.ds9a.nl">lartc-admin@mailman.ds9a.nl</A>]För Fredrik Rambris
&gt; Skickat: Wednesday, October 25, 2000 3:31 PM
&gt; Till: Linux Advanced Routing and Trafic Control
&gt; Ämne: [LARTC] Packet rewriting
&gt;
&gt;
&gt; Hello
&gt;
&gt; Now here's a problem I've never thought of before.
&gt;
&gt; We have been given a net from UUNET. The first IP-address (.161) is used
&gt; by their router (which we have no access to fiddle with). I have
&gt; installed a firewall at .162 which will serve both as firewall and
&gt; trafic controller. My question is how to I make the public IP-addresses
&gt; accessible from the outside and still be located behind the firewall?
&gt; Like this
&gt;
&gt; [Internet]--[UU-Router.161]--[Firewall.162]
&gt; I want to be able to put a machine behind the firewall on a public
&gt; IP-adress (.163) but still protected by the firewall. I was told that
&gt; this could be done in other firewalls by aliasing the NIC on the outside
&gt; to all public ip-addresses and then have the firewall forward these
&gt; packets to a computer on the inside. Like portforwarding but a whole
&gt; machine (all ports) on all protocols (under IP ofcause) (not blocked by
&gt; the firewall).
&gt;
&gt; Is this possible with ipchains and some fancy packetrewriting?
&gt;
&gt; Anyone have any tips?
&gt; --
&gt; Admera Solution Provider AB
&gt; Tel: 0733-850 814
&gt; Position: 55°36´13N 13°03´36E

</PRE>

^ permalink raw reply	[flat|nested] 2+ messages in thread