* SV: [LARTC] Packet rewriting
@ 2000-10-25 14:42 Daniel
2000-10-25 16:34 ` Daniel
0 siblings, 1 reply; 2+ messages in thread
From: Daniel @ 2000-10-25 14:42 UTC (permalink / raw)
To: lartc
<PRE>I'm not sure of what you want but here is an example:
(Assuming local net is 10.0.0.160/27)
# Accept icmp (for example ping)
ipchains -A output -p icmp -j ACCEPT
# Deny TCP sessions to local network (that is noone outside
# the firewall may access web, ftp,... at your local net)
# (Note the -y option)
ipchains -A output -p tcp -d 10.0.0.160/27 -y -j DENY
# Accept any TCP packets to local network
ipchains -A output -p tcp -d 10.0.0.160/27 -j ACCEPT
# Maybe you want some UDP ports open
# Accept port 4000/UDP to local network
ipchains -A output -p udp -d 10.0.0.160/27 4000 -j ACCEPT
# Deny anything else to local network
ipchains -A output -d 10.0.0.160/27 -j DENY
Regards,
Daniel
><i> -----Ursprungligt meddelande-----
</I>><i> Från: <A HREF="mailto:lartc-admin@mailman.ds9a.nl">lartc-admin@mailman.ds9a.nl</A>
</I>><i> [mailto:<A HREF="mailto:lartc-admin@mailman.ds9a.nl">lartc-admin@mailman.ds9a.nl</A>]För Fredrik Rambris
</I>><i> Skickat: Wednesday, October 25, 2000 3:31 PM
</I>><i> Till: Linux Advanced Routing and Trafic Control
</I>><i> Ämne: [LARTC] Packet rewriting
</I>><i>
</I>><i>
</I>><i> Hello
</I>><i>
</I>><i> Now here's a problem I've never thought of before.
</I>><i>
</I>><i> We have been given a net from UUNET. The first IP-address (.161) is used
</I>><i> by their router (which we have no access to fiddle with). I have
</I>><i> installed a firewall at .162 which will serve both as firewall and
</I>><i> trafic controller. My question is how to I make the public IP-addresses
</I>><i> accessible from the outside and still be located behind the firewall?
</I>><i> Like this
</I>><i>
</I>><i> [Internet]--[UU-Router.161]--[Firewall.162]
</I>><i> I want to be able to put a machine behind the firewall on a public
</I>><i> IP-adress (.163) but still protected by the firewall. I was told that
</I>><i> this could be done in other firewalls by aliasing the NIC on the outside
</I>><i> to all public ip-addresses and then have the firewall forward these
</I>><i> packets to a computer on the inside. Like portforwarding but a whole
</I>><i> machine (all ports) on all protocols (under IP ofcause) (not blocked by
</I>><i> the firewall).
</I>><i>
</I>><i> Is this possible with ipchains and some fancy packetrewriting?
</I>><i>
</I>><i> Anyone have any tips?
</I>><i> --
</I>><i> Admera Solution Provider AB
</I>><i> Tel: 0733-850 814
</I>><i> Position: 55°36´13N 13°03´36E
</I>
</PRE>
^ permalink raw reply [flat|nested] 2+ messages in thread
* SV: [LARTC] Packet rewriting
2000-10-25 14:42 SV: [LARTC] Packet rewriting Daniel
@ 2000-10-25 16:34 ` Daniel
0 siblings, 0 replies; 2+ messages in thread
From: Daniel @ 2000-10-25 16:34 UTC (permalink / raw)
To: lartc
<PRE>Hi Bert!
It seems he has got a ?.?.?.160/27 net and there .161 is the gateway. He may
add a firewall with two ethernet interfaces (like .162 and .163) and there
all computers behind the firewall uses .163 as default gateway. There is no
reason for the computers behind the firewall to be able to talk to the ISP
gateway (.161) (except for testing the firewall).
To use this:
Tell the ISP gateway (.161) to route all packets to .162.
Tell all local computers to use .163 as default gateway.
On the firewall computer:
# Route to the ISP gateway
ip route add 10.1.1.161 src 10.1.1.162 dev eth0 proto kernel table main
# Route .160/27 to local network
ip route add 10.1.1.160/27 dev eth2 table main
# Default route
ip route add 0.0.0.0/0 dev eth1 table main
# Flush cache
ip route flush cache
Regards,
Daniel
><i> -----Ursprungligt meddelande-----
</I>><i> Från: <A HREF="mailto:lartc-admin@mailman.ds9a.nl">lartc-admin@mailman.ds9a.nl</A>
</I>><i> [mailto:<A HREF="mailto:lartc-admin@mailman.ds9a.nl">lartc-admin@mailman.ds9a.nl</A>]För bert hubert
</I>><i> Skickat: Wednesday, October 25, 2000 6:26 PM
</I>><i> Till: Linux Advanced Routing and Trafic Control
</I>><i> Ämne: Re: [LARTC] Packet rewriting
</I>><i>
</I>><i>
</I>><i> On Wed, Oct 25, 2000 at 03:31:00PM +0200, Fredrik Rambris wrote:
</I>><i>
</I>><i> > [Internet]--[UU-Router.161]--[Firewall.162]
</I>><i> > I want to be able to put a machine behind the firewall on a public
</I>><i> > IP-adress (.163) but still protected by the firewall. I was told that
</I>><i> > this could be done in other firewalls by aliasing the NIC on the outside
</I>><i>
</I>><i> Are you very sure that have not been given yet another net, and
</I>><i> that this is
</I>><i> only the uplink LAN? The regular arrangement is to have two nets, and your
</I>><i> .162 machine in both of 'em.
</I>><i>
</I>><i> If you really only have one net, you need to do proxy arp for a
</I>><i> subnet. This
</I>><i> means that 162 will pretend to be all computers. You also need an extra
</I>><i> ethernet card.
</I>><i>
</I>><i> > Is this possible with ipchains and some fancy packetrewriting?
</I>><i>
</I>><i> You're note really rewriting packets, you're just passing them
</I>><i> around. I've
</I>><i> built a setup like this and it works.
</I>><i>
</I>><i> However, I'm not sure how you setup proxy arp in 2.2. There might be three
</I>><i> ways:
</I>><i>
</I>><i> 1) 'arp'
</I>><i> 2) 'ip neigh'
</I>><i> 3) '/proc/something/proxy_arp'
</I>><i>
</I>><i> 1) Used to work but I seem to remember that it is now deprecated
</I>><i> 2) may work even if 1) doesn't
</I>><i> 3) may be the 'new wave', but I'm not sure how it works.
</I>><i>
</I>><i> Regards,
</I>><i>
</I>><i> bert hubert
</I>><i>
</I>><i> --
</I>><i> PowerDNS Versatile DNS Services
</I>><i> Trilab The Technology People
</I>><i> 'SYN! .. SYN|ACK! .. ACK!' - the mating call of the internet
</I>><i>
</I>><i> _______________________________________________
</I>><i> LARTC mailing list / <A HREF="mailto:LARTC@mailman.ds9a.nl">LARTC@mailman.ds9a.nl</A>
</I>><i> <A HREF="http://mailman.ds9a.nl/mailman/listinfo/lartc">http://mailman.ds9a.nl/mailman/listinfo/lartc</A> HOWTO:
</I><A HREF="http://ds9a.nl/2.4Routing/">http://ds9a.nl/2.4Routing/</A>
</PRE>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2000-10-25 16:34 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2000-10-25 14:42 SV: [LARTC] Packet rewriting Daniel
2000-10-25 16:34 ` Daniel
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.