set up my DMZ

set up my DMZ

[hamals]

I've a DMZ with two server, I would like to acces them 
through my iptables firewall.

IP_serve1_DMZ =192.168.2.2
IP_serve2_DMZ =192.168.2.3

IP_server1_public = x.x.x.52
IP_server2_public = x.x.x.53   (x is for privacy..)


My firewall has

eth1 internet interface = x.x.x.50
eth0 dmz interface = 192.168.2.1

I need to have my server access with their pubbic IP, but 
I've only eth1 as inteface to internet.

I read that I can't use alias in iptables rules (like 
eth1:1 etc) , then what kind of rules have I to write to 
solve my problem?

Thanks
_______________________________________
Connessione ed e-mail gratuita da 10 mb
consultabile tramite web e tramite pop.
www.infinito.it vieni a scoprire tutti 
i nostri servizi!

http://www.infinito.it/xmail

Re: set up my DMZ

[John A. Sullivan III]

On Thu, 2004-09-16 at 10:44, hamals@infinito.it wrote:
> I've a DMZ with two server, I would like to acces them 
> through my iptables firewall.
> 
> IP_serve1_DMZ =192.168.2.2
> IP_serve2_DMZ =192.168.2.3
> 
> IP_server1_public = x.x.x.52
> IP_server2_public = x.x.x.53   (x is for privacy..)
> 
> 
> My firewall has
> 
> eth1 internet interface = x.x.x.50
> eth0 dmz interface = 192.168.2.1
> 
> I need to have my server access with their pubbic IP, but 
> I've only eth1 as inteface to internet.
> 
> I read that I can't use alias in iptables rules (like 
> eth1:1 etc) , then what kind of rules have I to write to 
> solve my problem?
<snip>
If I understand you correctly, simple NAT should be your answer.

iptables -t nat -A PREROUTING -d x.x.x.52 -j DNAT --to-destination
192.168.2.2 (optionally add -i eth1 to thematch if you do are not using
split DNS for any internal neworks)

You will also need filter table rules to explicitly allow the DNAT'd
traffic to pass.
-- 
John A. Sullivan III
Chief Technology Officer
Nexus Management
+1 207-985-7880
john.sullivan@nexusmgmt.com
---
If you are interested in helping to develop a GPL enterprise class
VPN/Firewall/Security device management console, please visit
http://iscs.sourceforge.net 

Re: set up my DMZ

[Jason Opperisano]

On Thu, 2004-09-16 at 10:44, hamals@infinito.it wrote:
> I've a DMZ with two server, I would like to acces them 
> through my iptables firewall.
> 
> IP_serve1_DMZ =192.168.2.2
> IP_serve2_DMZ =192.168.2.3
> 
> IP_server1_public = x.x.x.52
> IP_server2_public = x.x.x.53   (x is for privacy..)
> 
> 
> My firewall has
> 
> eth1 internet interface = x.x.x.50
> eth0 dmz interface = 192.168.2.1
> 
> I need to have my server access with their pubbic IP, but 
> I've only eth1 as inteface to internet.
> 
> I read that I can't use alias in iptables rules (like 
> eth1:1 etc) , then what kind of rules have I to write to 
> solve my problem?

  ip address add x.x.x.52 dev eth1
  ip address add x.x.x.53 dev eth1

  iptables -t nat -A PREROUTING -i eth1 -d x.x.x.52 \
    -j DNAT --to-destination 192.168.2.2

  iptables -t nat -A PREROUTING -i eth1 -d x.x.x.53 \
    -j DNAT --to-destination 192.168.2.3

filter rules as necessary (remember to use the 192.168.2.x address in
your filter rules)...

HTH...

-j

-- 
Jason Opperisano <opie@817west.com>

Fwd: set up my DMZ

[Mohamed Eldesoky]

---------- Forwarded message ----------
From: Mohamed Eldesoky <eldesoky.lists@gmail.com>
Date: Sun, 19 Sep 2004 11:12:13 +0300
Subject: Re: set up my DMZ
To: Jason Opperisano <opie@817west.com>

On Thu, 16 Sep 2004 13:39:51 -0400, Jason Opperisano <opie@817west.com> wrote:
> On Thu, 2004-09-16 at 10:44, hamals@infinito.it wrote:
> > I've a DMZ with two server, I would like to acces them
> > through my iptables firewall.
> >
> > IP_serve1_DMZ =192.168.2.2
> > IP_serve2_DMZ =192.168.2.3
> >
> > IP_server1_public = x.x.x.52
> > IP_server2_public = x.x.x.53   (x is for privacy..)
> >
> >
> > My firewall has
> >
> > eth1 internet interface = x.x.x.50
> > eth0 dmz interface = 192.168.2.1
> >
> > I need to have my server access with their pubbic IP, but
> > I've only eth1 as inteface to internet.
> >
> > I read that I can't use alias in iptables rules (like
> > eth1:1 etc) , then what kind of rules have I to write to
> > solve my problem?
>
>   ip address add x.x.x.52 dev eth1
>   ip address add x.x.x.53 dev eth1
>

He really needs to do this step ????
The firewall is his gateway !!




> --
> Jason Opperisano <opie@817west.com>
>
>


--
Mohamed Eldesoky
www.eldesoky.net
RHCE




-- 
Mohamed Eldesoky
www.eldesoky.net
RHCE

Re: Fwd: set up my DMZ

[Jason Opperisano]

On Sun, 2004-09-19 at 04:12, Mohamed Eldesoky wrote:
> >   ip address add x.x.x.52 dev eth1
> >   ip address add x.x.x.53 dev eth1
> >
> 
> He really needs to do this step ????
> The firewall is his gateway !!

yes.  he does.  the firewall is his gateway on the inside/dmz.  these IP
aliases are on the outside, internet-facing interface.

-j

-- 
Jason Opperisano <opie@817west.com>

set up my DMZ

[hamals]

I've a DMZ with two server, I would like to acces them 
through my iptables firewall.

IP_serve1_DMZ =192.168.2.2
IP_serve2_DMZ =192.168.2.3

IP_server1_public = x.x.x.52
IP_server2_public = x.x.x.53 (x is for privacy..)


My firewall has

eth1 internet interface = x.x.x.50
eth0 dmz interface = 192.168.2.1

I need to have my server access with their pubbic IP, but 
I've only eth1 as inteface to internet.

I read that I can't use alias in iptables rules (like 
eth1:1 etc) , then what kind of rules have I to write to 
solve my problem?


I did this script but is it not working,
what do you think is wrong in it?



#!/bin/bash


iptables -F

iptables -t nat -F

iptables -t mangle -F

# filter table everythingd is ACCEPT  only to follow the 
easyest way#

iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT

## make DMZ -> internet ##

iptables -t nat -A POSTROUTING -s 192.168.2.1 -o eth1 -j 
SNAT --to-source 82.190.228.52


## make internet -> DMZ ##

iptables -t nat -A PREROUTING -i eth1 -d x.x.x.52 -j DNAT 
--to-destination 192.168.2.1


Thanks
_______________________________________
Connessione ed e-mail gratuita da 10 mb
consultabile tramite web e tramite pop.
www.infinito.it vieni a scoprire tutti 
i nostri servizi!

http://www.infinito.it/xmail

Re: set up my DMZ

[Jason Opperisano]

On Fri, 2004-09-17 at 05:37, hamals@infinito.it wrote:
> #!/bin/bash
> 
> 
> iptables -F
> 
> iptables -t nat -F
> 
> iptables -t mangle -F
> 
> # filter table everythingd is ACCEPT  only to follow the 
> easyest way#
> 
> iptables -P INPUT ACCEPT
> iptables -P FORWARD ACCEPT
> iptables -P OUTPUT ACCEPT
> 
> ## make DMZ -> internet ##
> 
> iptables -t nat -A POSTROUTING -s 192.168.2.1 -o eth1 -j 
> SNAT --to-source 82.190.228.52
> 
> 
> ## make internet -> DMZ ##
> 
> iptables -t nat -A PREROUTING -i eth1 -d x.x.x.52 -j DNAT 
> --to-destination 192.168.2.1

sysctl -w net.ipv4.ip_forward=1

-j

-- 
Jason Opperisano <opie@817west.com>