From: Daniel Bergqvist daniel@netatonce.se
To: lartc@vger.kernel.org
Subject: SV: [LARTC] Packet rewriting
Date: Wed, 25 Oct 2000 16:34:02 +0000 [thread overview]
Message-ID: <marc-lartc-98373938216846@msgid-missing> (raw)
In-Reply-To: <marc-lartc-98373938216842@msgid-missing>
<PRE>Hi Bert!
It seems he has got a ?.?.?.160/27 net and there .161 is the gateway. He may
add a firewall with two ethernet interfaces (like .162 and .163) and there
all computers behind the firewall uses .163 as default gateway. There is no
reason for the computers behind the firewall to be able to talk to the ISP
gateway (.161) (except for testing the firewall).
To use this:
Tell the ISP gateway (.161) to route all packets to .162.
Tell all local computers to use .163 as default gateway.
On the firewall computer:
# Route to the ISP gateway
ip route add 10.1.1.161 src 10.1.1.162 dev eth0 proto kernel table main
# Route .160/27 to local network
ip route add 10.1.1.160/27 dev eth2 table main
# Default route
ip route add 0.0.0.0/0 dev eth1 table main
# Flush cache
ip route flush cache
Regards,
Daniel
><i> -----Ursprungligt meddelande-----
</I>><i> Från: <A HREF="mailto:lartc-admin@mailman.ds9a.nl">lartc-admin@mailman.ds9a.nl</A>
</I>><i> [mailto:<A HREF="mailto:lartc-admin@mailman.ds9a.nl">lartc-admin@mailman.ds9a.nl</A>]För bert hubert
</I>><i> Skickat: Wednesday, October 25, 2000 6:26 PM
</I>><i> Till: Linux Advanced Routing and Trafic Control
</I>><i> Ämne: Re: [LARTC] Packet rewriting
</I>><i>
</I>><i>
</I>><i> On Wed, Oct 25, 2000 at 03:31:00PM +0200, Fredrik Rambris wrote:
</I>><i>
</I>><i> > [Internet]--[UU-Router.161]--[Firewall.162]
</I>><i> > I want to be able to put a machine behind the firewall on a public
</I>><i> > IP-adress (.163) but still protected by the firewall. I was told that
</I>><i> > this could be done in other firewalls by aliasing the NIC on the outside
</I>><i>
</I>><i> Are you very sure that have not been given yet another net, and
</I>><i> that this is
</I>><i> only the uplink LAN? The regular arrangement is to have two nets, and your
</I>><i> .162 machine in both of 'em.
</I>><i>
</I>><i> If you really only have one net, you need to do proxy arp for a
</I>><i> subnet. This
</I>><i> means that 162 will pretend to be all computers. You also need an extra
</I>><i> ethernet card.
</I>><i>
</I>><i> > Is this possible with ipchains and some fancy packetrewriting?
</I>><i>
</I>><i> You're note really rewriting packets, you're just passing them
</I>><i> around. I've
</I>><i> built a setup like this and it works.
</I>><i>
</I>><i> However, I'm not sure how you setup proxy arp in 2.2. There might be three
</I>><i> ways:
</I>><i>
</I>><i> 1) 'arp'
</I>><i> 2) 'ip neigh'
</I>><i> 3) '/proc/something/proxy_arp'
</I>><i>
</I>><i> 1) Used to work but I seem to remember that it is now deprecated
</I>><i> 2) may work even if 1) doesn't
</I>><i> 3) may be the 'new wave', but I'm not sure how it works.
</I>><i>
</I>><i> Regards,
</I>><i>
</I>><i> bert hubert
</I>><i>
</I>><i> --
</I>><i> PowerDNS Versatile DNS Services
</I>><i> Trilab The Technology People
</I>><i> 'SYN! .. SYN|ACK! .. ACK!' - the mating call of the internet
</I>><i>
</I>><i> _______________________________________________
</I>><i> LARTC mailing list / <A HREF="mailto:LARTC@mailman.ds9a.nl">LARTC@mailman.ds9a.nl</A>
</I>><i> <A HREF="http://mailman.ds9a.nl/mailman/listinfo/lartc">http://mailman.ds9a.nl/mailman/listinfo/lartc</A> HOWTO:
</I><A HREF="http://ds9a.nl/2.4Routing/">http://ds9a.nl/2.4Routing/</A>
</PRE>
prev parent reply other threads:[~2000-10-25 16:34 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2000-10-25 14:42 SV: [LARTC] Packet rewriting Daniel
2000-10-25 16:34 ` Daniel [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=marc-lartc-98373938216846@msgid-missing \
--to=lartc@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.