[LARTC] iproute2 and routing entries

[Michael Schoen schoen@anduras.de]

<PRE>hi,
&gt;<i> The last I heard was that one of the networking guys gave this explanantion
</I>&gt;<i> and challenged someone to give an example of where this was the wrong
</I>&gt;<i> thing to do. The thread died there IIRC.
</I>&gt;<i> 
</I>&gt;<i> Personally I think it's a great feature because in at least 99.99% of 
</I>&gt;<i> cases it's exactly what you want and I havn't found an example of the
</I>&gt;<i> other 0.01%.
</I>
okay - here¥s a strange set-up, but if you think over it, it has some nice
advantages.

Assume you have a public network (e.g. 132.231.1.0) routed to your fw/gateway. 
For the dmz you use a private network (e.g. 10.10.10.0). In the dmz you have 
two public server (www 132.231.1.1 and mail 132.231.1.2).

on the internal interface of the gw/fw use the ip 10.10.10.254. The two
public server have the 2nd adress 10.10.10.1 (www) and 10.10.10.2 (mail).

Now use the following route-entries:

www and mail:
10.10.10.0/24 -&gt; eth0
default	      -&gt; 10.10.10.254

and on the firewall you set the following route entries:
10.10.10.0/24 -&gt; eth0
132.231.1.1/32 -&gt; 10.10.10.1
132.231.1.2/32 -&gt; 10.10.10.2

This design has the (dis?)advantage that every packet with public ip
addresses within the dmz is routed again over the fw/gw. For some 
security/accounting reasons this is not a bad idea &lt;g&gt;


   .\\ichael Schoen

--
 Michael Schoen   &lt;<A HREF="mailto:schoen@anduras.de">schoen@anduras.de</A>&gt;                      _/_/_/
                                                          _/_/_/
 ANDURAS AG i.G.      Internet: www.anduras.de           _/_/_/
 Innstrafle 71         Tel: 0851/4 90 50-0               _/_/_/
 94036 Passau         Fax: 0851/4 90 50-55             _/_/_/
_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/



</PRE>