From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Ryan Beisner" Subject: DMZ Scenario Date: Thu, 14 Nov 2002 18:33:45 -0600 Sender: netfilter-admin@lists.netfilter.org Message-ID: <000c01c28c3e$ab3603a0$64dc0a0a@i> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0009_01C28C0C.5D66A760" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter@lists.netfilter.org This is a multi-part message in MIME format. ------=_NextPart_000_0009_01C28C0C.5D66A760 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hi I have successfully installed a mail + web server in my new dmz, = filtered by netfilter in Redhat 7.3. My problem is, the request = addresses show up as the dmz interface's ip address (of the packet = filter box). This presents a problem with Sendmail, Postfix, Apache, = etc. for logging and security purposes. For instance, to allow Postfix = to relay for your specific IP range, it won't work because Postfix & = Sendmail see xxx.xxx.177.25 as the originating IP. So, the effect is that EVERYONE can relay through the box ... uh oh! = I've temporarily moved it back into the real world with it's own = iptables script. For lots of reasons, I want it in the DMZ. Is there a way to forward packets without MASQing? I think that's what = I need to do here. All help is appreciated. Thanks! ps. You'll notice that right now I'm allowing ALL traffic to/fro these = two DMZ ip's. I plan to tighten that up later. . . . . xxx's =3D external IPs ............... PRESext=3Dxxx.xxx.177.24 KEYext=3Dxxx.xxx.177.25 PRESdmz=3D10.10.177.24 KEYdmz=3D10.10.177.25 $ipt -A FORWARD -s 0/0 -d $PRESext -j ACCEPT $ipt -A FORWARD -s $PRESext -d 0/0 -j ACCEPT $ipt -A FORWARD -s 0/0 -d $PRESdmz -j ACCEPT $ipt -A FORWARD -s $PRESdmz -d 0/0 -j ACCEPT $ipt -A PREROUTING -t nat -d $PRESext -j DNAT --to $PRESdmz $ipt -A POSTROUTING -t nat -d $PRESdmz -j SNAT --to $PRESext $ipt -A FORWARD -s 0/0 -d $KEYext -j ACCEPT $ipt -A FORWARD -s $KEYext -d 0/0 -j ACCEPT $ipt -A FORWARD -s 0/0 -d $KEYdmz -j ACCEPT $ipt -A FORWARD -s $KEYdmz -d 0/0 -j ACCEPT $ipt -A PREROUTING -t nat -d $KEYext -j DNAT --to $KEYdmz $ipt -A POSTROUTING -t nat -d $KEYdmz -j SNAT --to $KEYext ............... . . . . . . TIA -Ryan Beisner =3D=3D=3Dlinux everywhere=3D=3D=3D ------=_NextPart_000_0009_01C28C0C.5D66A760 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Hi
 
I have successfully installed a mail + = web server=20 in my new dmz, filtered by netfilter in Redhat 7.3.  My problem is, = the=20 request addresses show up as the dmz interface's ip address (of the = packet=20 filter box).  This presents a problem with Sendmail, Postfix, = Apache, etc.=20 for logging and security purposes.  For instance, to allow Postfix = to relay=20 for your specific IP range, it won't work because Postfix & Sendmail = see=20 xxx.xxx.177.25 as the originating IP.
 
So, the effect is that EVERYONE can = relay through=20 the box ... uh oh!   I've temporarily moved it back into the = real=20 world with it's own iptables script.  For lots of reasons, I want = it in the=20 DMZ.
 
Is there a way to forward packets = without=20 MASQing?  I think that's what I need to do here.  All help is=20 appreciated.  Thanks!
 
ps.  You'll notice that right now = I'm allowing=20 ALL traffic to/fro these two DMZ ip's.  I plan to tighten that up=20 later.
.
.
.
.
xxx's =3D external IPs
...............
 
PRESext=3Dxxx.xxx.177.24
KEYext=3Dxxx.xxx.177.25
PRESdmz=3D= 10.10.177.24
KEYdmz=3D10.10.177.25
 
$ipt -A FORWARD -s 0/0 -d $PRESext -j=20 ACCEPT
$ipt -A FORWARD -s $PRESext -d 0/0 -j ACCEPT
$ipt -A FORWARD -s 0/0 -d $PRESdmz -j=20 ACCEPT
$ipt -A FORWARD -s $PRESdmz -d 0/0 -j ACCEPT
 
$ipt -A PREROUTING -t nat -d $PRESext = -j DNAT --to=20 $PRESdmz
$ipt -A POSTROUTING -t nat -d $PRESdmz -j SNAT --to=20 $PRESext
 
 
$ipt -A FORWARD -s 0/0 -d $KEYext -j = ACCEPT
$ipt=20 -A FORWARD -s $KEYext -d 0/0 -j ACCEPT
$ipt -A FORWARD -s 0/0 -d $KEYdmz -j = ACCEPT
$ipt=20 -A FORWARD -s $KEYdmz -d 0/0 -j ACCEPT
 
$ipt -A PREROUTING -t nat -d $KEYext -j = DNAT --to=20 $KEYdmz
$ipt -A POSTROUTING -t nat -d $KEYdmz -j SNAT --to=20 $KEYext
...............
.
.
.
.
.
.
TIA
 
-Ryan Beisner
 
 
=3D=3D=3Dlinux = everywhere=3D=3D=3D
------=_NextPart_000_0009_01C28C0C.5D66A760-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Joel Newkirk Subject: Re: DMZ Scenario Date: Thu, 14 Nov 2002 20:29:57 -0500 Sender: netfilter-admin@lists.netfilter.org Message-ID: <200211142029.57679.netfilter@newkirk.us> References: <000c01c28c3e$ab3603a0$64dc0a0a@i> Reply-To: netfilter@newkirk.us Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <000c01c28c3e$ab3603a0$64dc0a0a@i> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: Ryan Beisner , netfilter@lists.netfilter.org On Thursday 14 November 2002 07:33 pm, Ryan Beisner wrote: > Hi > > I have successfully installed a mail + web server in my new dmz, filter= ed > by netfilter in Redhat 7.3. My problem is, the request addresses show = up > as the dmz interface's ip address (of the packet filter box). This > $ipt -A PREROUTING -t nat -d $PRESext -j DNAT --to $PRESdmz > $ipt -A POSTROUTING -t nat -d $PRESdmz -j SNAT --to $PRESext > $ipt -A PREROUTING -t nat -d $KEYext -j DNAT --to $KEYdmz > $ipt -A POSTROUTING -t nat -d $KEYdmz -j SNAT --to $KEYext Drop the SNAT rules. In the PRE you take anything coming in the 'real' I= P and=20 change it's destination to the dmz IP. But in the POST you take those sa= me=20 packets and change their source to the real IP. If you drop the POST rul= es,=20 then the packets will just pass on to $PRESdmz with their (presumably) re= al=20 source IP intact. j From mboxrd@z Thu Jan 1 00:00:00 1970 From: "ryan @ thedataarc" Subject: Re: DMZ Scenario Date: 14 Nov 2002 20:57:37 -0600 Sender: netfilter-admin@lists.netfilter.org Message-ID: <1037329062.2827.2.camel@rbhome.inside.thedataarc.com> References: <000c01c28c3e$ab3603a0$64dc0a0a@i> <200211142029.57679.netfilter@newkirk.us> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <200211142029.57679.netfilter@newkirk.us> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: netfilter@newkirk.us Cc: netfilter@lists.netfilter.org Aha! Thanks so much. -R Beisner On Thu, 2002-11-14 at 19:29, Joel Newkirk wrote: > On Thursday 14 November 2002 07:33 pm, Ryan Beisner wrote: > > Hi > > > > I have successfully installed a mail + web server in my new dmz, filtered > > by netfilter in Redhat 7.3. My problem is, the request addresses show up > > as the dmz interface's ip address (of the packet filter box). This > > > $ipt -A PREROUTING -t nat -d $PRESext -j DNAT --to $PRESdmz > > $ipt -A POSTROUTING -t nat -d $PRESdmz -j SNAT --to $PRESext > > > $ipt -A PREROUTING -t nat -d $KEYext -j DNAT --to $KEYdmz > > $ipt -A POSTROUTING -t nat -d $KEYdmz -j SNAT --to $KEYext > > Drop the SNAT rules. In the PRE you take anything coming in the 'real' IP and > change it's destination to the dmz IP. But in the POST you take those same > packets and change their source to the real IP. If you drop the POST rules, > then the packets will just pass on to $PRESdmz with their (presumably) real > source IP intact. > > j >