Hi
I have successfully installed a mail + web server
in my new dmz, filtered by netfilter in Redhat 7.3. My problem is, the
request addresses show up as the dmz interface's ip address (of the packet
filter box). This presents a problem with Sendmail, Postfix, Apache, etc.
for logging and security purposes. For instance, to allow Postfix to relay
for your specific IP range, it won't work because Postfix & Sendmail see
xxx.xxx.177.25 as the originating IP.
So, the effect is that EVERYONE can relay through
the box ... uh oh! I've temporarily moved it back into the real
world with it's own iptables script. For lots of reasons, I want it in the
DMZ.
Is there a way to forward packets without
MASQing? I think that's what I need to do here. All help is
appreciated. Thanks!
ps. You'll notice that right now I'm allowing
ALL traffic to/fro these two DMZ ip's. I plan to tighten that up
later.
.
.
.
.
xxx's = external IPs
PRESext=xxx.xxx.177.24
KEYext=xxx.xxx.177.25
PRESdmz=10.10.177.24
KEYdmz=10.10.177.25
$ipt -A FORWARD -s 0/0 -d $PRESext -j
ACCEPT
$ipt -A FORWARD -s $PRESext -d 0/0 -j ACCEPT
$ipt -A FORWARD -s 0/0 -d $PRESdmz -j
ACCEPT
$ipt -A FORWARD -s $PRESdmz -d 0/0 -j ACCEPT
$ipt -A PREROUTING -t nat -d $PRESext -j DNAT --to
$PRESdmz
$ipt -A POSTROUTING -t nat -d $PRESdmz -j SNAT --to
$PRESext
$ipt -A FORWARD -s 0/0 -d $KEYext -j ACCEPT
$ipt
-A FORWARD -s $KEYext -d 0/0 -j ACCEPT
$ipt -A FORWARD -s 0/0 -d $KEYdmz -j ACCEPT
$ipt
-A FORWARD -s $KEYdmz -d 0/0 -j ACCEPT
$ipt -A PREROUTING -t nat -d $KEYext -j DNAT --to
$KEYdmz
$ipt -A POSTROUTING -t nat -d $KEYdmz -j SNAT --to
$KEYext
...............
.
.
.
.
.
.
TIA
-Ryan Beisner
===linux everywhere===