DMZ Scenario

["Ryan Beisner" <ryanb@thedataarc.com>]

[-- Attachment #1: Type: text/plain, Size: 1762 bytes --]

Hi

I have successfully installed a mail + web server in my new dmz, filtered by netfilter in Redhat 7.3.  My problem is, the request addresses show up as the dmz interface's ip address (of the packet filter box).  This presents a problem with Sendmail, Postfix, Apache, etc. for logging and security purposes.  For instance, to allow Postfix to relay for your specific IP range, it won't work because Postfix & Sendmail see xxx.xxx.177.25 as the originating IP.

So, the effect is that EVERYONE can relay through the box ... uh oh!   I've temporarily moved it back into the real world with it's own iptables script.  For lots of reasons, I want it in the DMZ.

Is there a way to forward packets without MASQing?  I think that's what I need to do here.  All help is appreciated.  Thanks!

ps.  You'll notice that right now I'm allowing ALL traffic to/fro these two DMZ ip's.  I plan to tighten that up later.
.
.
.
.
xxx's = external IPs
...............

PRESext=xxx.xxx.177.24
KEYext=xxx.xxx.177.25
PRESdmz=10.10.177.24
KEYdmz=10.10.177.25

$ipt -A FORWARD -s 0/0 -d $PRESext -j ACCEPT
$ipt -A FORWARD -s $PRESext -d 0/0 -j ACCEPT
$ipt -A FORWARD -s 0/0 -d $PRESdmz -j ACCEPT
$ipt -A FORWARD -s $PRESdmz -d 0/0 -j ACCEPT

$ipt -A PREROUTING -t nat -d $PRESext -j DNAT --to $PRESdmz
$ipt -A POSTROUTING -t nat -d $PRESdmz -j SNAT --to $PRESext


$ipt -A FORWARD -s 0/0 -d $KEYext -j ACCEPT
$ipt -A FORWARD -s $KEYext -d 0/0 -j ACCEPT
$ipt -A FORWARD -s 0/0 -d $KEYdmz -j ACCEPT
$ipt -A FORWARD -s $KEYdmz -d 0/0 -j ACCEPT

$ipt -A PREROUTING -t nat -d $KEYext -j DNAT --to $KEYdmz
$ipt -A POSTROUTING -t nat -d $KEYdmz -j SNAT --to $KEYext
...............
.
.
.
.
.
.
TIA

-Ryan Beisner


===linux everywhere===

[-- Attachment #2: Type: text/html, Size: 3624 bytes --]