From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Luca Scattin" Subject: Bridge-firewall Date: Wed, 3 Dec 2003 13:55:13 +0100 Sender: netfilter-admin@lists.netfilter.org Message-ID: <009901c3b99c$b18b9ee0$1e00a8c0@MERCURIO> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0096_01C3B9A5.1312D6D0" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter@lists.netfilter.org This is a multi-part message in MIME format. ------=_NextPart_000_0096_01C3B9A5.1312D6D0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hello all. I have a little problem to build a solution for a customer (an hotel). I try to explai the situation with an ascii art -------------- | PC | | Clent | ------------- | ip =20 | -------------- | Firewall | | Bridge | ------------- | | |192.168.0.254 (example) -------------- | router | | | ------------- | Public IP =20 Internet Client pc have your IP address and default gateway that it's impossible = to change. Bridge/Firewall have to accept all pachets with all ip adress (no = problem... it' a bridge) and have to change the ip address of all = packets in order to send correctly to the router. I build the bridge correctly (I Think) with: brctl addbr br0 brctl stp br0 off brctl addif br0 eth0 brctl addif br0 eth1 ifconfig eth0 0.0.0.0 up ifconfig eth1 0.0.0.0 up ifconfig bro 0.0.0.0 up route add default gw 192.158.0.254 echo "1" > /proc/sys/net/ipv4/ip_forward After that bridge is working. I try to dump pachets in eth0 and eth1 and packest cross the bridge. Noy I try to modify cleint packet address using SNAT iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to 192.168.0.21 = (example). but in the second interface i view allvays the original client = packets....=20 I mistake something but I don't know what. I need help. Thanks =20 Luca Scattin ------=_NextPart_000_0096_01C3B9A5.1312D6D0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Hello all.

I have a little problem to build a = solution for a=20 customer (an hotel).

I try to explai the situation with an = ascii=20 art

--------------
|     =20 PC        |
|   =20 Clent      =20 |
-------------
        | = ip
      &= nbsp;=20 |
--------------
| Firewall    =20 |
|   Bridge     =20 |
-------------
       =20 |
       =20 |
        |192.168.0.254=20 (example)
--------------
| =20 router       =20 |
|           &= nbsp;      =20 |
-------------
        = | Public=20 IP            = ;  =20
Internet

Client pc have your IP address and = default gateway=20 that it's impossible to change.

Bridge/Firewall have to accept all = pachets with all=20 ip adress (no problem... it' a bridge) and have to change the ip address = of all=20 packets in order to send correctly to the router.

I build the bridge correctly (I Think)=20 with:

brctl addbr br0

brctl stp br0 off

brctl addif br0 eth0

brctl addif br0 eth1

ifconfig eth0 0.0.0.0 up

ifconfig eth1 0.0.0.0 up

ifconfig bro 0.0.0.0 up

route add default gw = 192.158.0.254

echo "1" >=20 /proc/sys/net/ipv4/ip_forward

After that bridge is = working.

I try to dump pachets in eth0 and eth1 = and packest=20 cross the bridge.

Noy I try to modify cleint packet = address using=20 SNAT

iptables -t nat -A POSTROUTING -o eth1 = -j SNAT --to=20 192.168.0.21 (example).

but in the second interface i view = allvays the=20 original client packets....

I mistake something but I don't know=20 what.

I need help.

Thanks

Luca=20 Scattin

------=_NextPart_000_0096_01C3B9A5.1312D6D0--