DMZ Scenario

DMZ Scenario

[Ryan Beisner]

[-- Attachment #1: Type: text/plain, Size: 1762 bytes --]

Hi

I have successfully installed a mail + web server in my new dmz, filtered by netfilter in Redhat 7.3.  My problem is, the request addresses show up as the dmz interface's ip address (of the packet filter box).  This presents a problem with Sendmail, Postfix, Apache, etc. for logging and security purposes.  For instance, to allow Postfix to relay for your specific IP range, it won't work because Postfix & Sendmail see xxx.xxx.177.25 as the originating IP.

So, the effect is that EVERYONE can relay through the box ... uh oh!   I've temporarily moved it back into the real world with it's own iptables script.  For lots of reasons, I want it in the DMZ.

Is there a way to forward packets without MASQing?  I think that's what I need to do here.  All help is appreciated.  Thanks!

ps.  You'll notice that right now I'm allowing ALL traffic to/fro these two DMZ ip's.  I plan to tighten that up later.
.
.
.
.
xxx's = external IPs
...............

PRESext=xxx.xxx.177.24
KEYext=xxx.xxx.177.25
PRESdmz=10.10.177.24
KEYdmz=10.10.177.25

$ipt -A FORWARD -s 0/0 -d $PRESext -j ACCEPT
$ipt -A FORWARD -s $PRESext -d 0/0 -j ACCEPT
$ipt -A FORWARD -s 0/0 -d $PRESdmz -j ACCEPT
$ipt -A FORWARD -s $PRESdmz -d 0/0 -j ACCEPT

$ipt -A PREROUTING -t nat -d $PRESext -j DNAT --to $PRESdmz
$ipt -A POSTROUTING -t nat -d $PRESdmz -j SNAT --to $PRESext


$ipt -A FORWARD -s 0/0 -d $KEYext -j ACCEPT
$ipt -A FORWARD -s $KEYext -d 0/0 -j ACCEPT
$ipt -A FORWARD -s 0/0 -d $KEYdmz -j ACCEPT
$ipt -A FORWARD -s $KEYdmz -d 0/0 -j ACCEPT

$ipt -A PREROUTING -t nat -d $KEYext -j DNAT --to $KEYdmz
$ipt -A POSTROUTING -t nat -d $KEYdmz -j SNAT --to $KEYext
...............
.
.
.
.
.
.
TIA

-Ryan Beisner


===linux everywhere===

[-- Attachment #2: Type: text/html, Size: 3624 bytes --]

Re: DMZ Scenario

[Joel Newkirk]

On Thursday 14 November 2002 07:33 pm, Ryan Beisner wrote:
> Hi
>
> I have successfully installed a mail + web server in my new dmz, filtered
> by netfilter in Redhat 7.3.  My problem is, the request addresses show up
> as the dmz interface's ip address (of the packet filter box).  This

> $ipt -A PREROUTING -t nat -d $PRESext -j DNAT --to $PRESdmz
> $ipt -A POSTROUTING -t nat -d $PRESdmz -j SNAT --to $PRESext

> $ipt -A PREROUTING -t nat -d $KEYext -j DNAT --to $KEYdmz
> $ipt -A POSTROUTING -t nat -d $KEYdmz -j SNAT --to $KEYext

Drop the SNAT rules.  In the PRE you take anything coming in the 'real' IP and 
change it's destination to the dmz IP.  But in the POST you take those same 
packets and change their source to the real IP.  If you drop the POST rules, 
then the packets will just pass on to $PRESdmz with their (presumably) real 
source IP intact.

j

Re: DMZ Scenario

[ryan @ thedataarc]

Aha!  Thanks so much.  

-R Beisner


On Thu, 2002-11-14 at 19:29, Joel Newkirk wrote:
> On Thursday 14 November 2002 07:33 pm, Ryan Beisner wrote:
> > Hi
> >
> > I have successfully installed a mail + web server in my new dmz, filtered
> > by netfilter in Redhat 7.3.  My problem is, the request addresses show up
> > as the dmz interface's ip address (of the packet filter box).  This
> 
> > $ipt -A PREROUTING -t nat -d $PRESext -j DNAT --to $PRESdmz
> > $ipt -A POSTROUTING -t nat -d $PRESdmz -j SNAT --to $PRESext
> 
> > $ipt -A PREROUTING -t nat -d $KEYext -j DNAT --to $KEYdmz
> > $ipt -A POSTROUTING -t nat -d $KEYdmz -j SNAT --to $KEYext
> 
> Drop the SNAT rules.  In the PRE you take anything coming in the 'real' IP and 
> change it's destination to the dmz IP.  But in the POST you take those same 
> packets and change their source to the real IP.  If you drop the POST rules, 
> then the packets will just pass on to $PRESdmz with their (presumably) real 
> source IP intact.
> 
> j
>