need to forward req between same network ip within same machine

need to forward req between same network ip within same machine

[Sathi]

Hello All,

I have a Redhat linux box with two NIC which i am going to use as firewall
machine.

Foe some reason i want to assign a ip address for these 2 NIC in same
network say

eth0: 10.10.10.1/24----------> to router
eth1: 10.10.10.2/24<---------- from client

eth0 and eth1 are connected in different switch

All clients are connected through eth1.I did not want any masquerading to
happen here.i want to just forward the request from eth1 to eth0 and
response from eth0 to eth1

i test with these rules as

iptables -A FORWARD -i eth1 -o eth0 -p all -s 10.10.10.0/24 -d 0/0 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -p all -s 0/0 -d 10.10.10.0/24 -j ACCEPT

but this doesn't work
clients are unable to connect internet

I enabled ip_forward in kernel also.

What should be the exact rule to make clients use internet through this
linux box.

Do i need to change anything do with routing table
What should be a entry in the routing table

Thanks
Sathi

Re: need to forward req between same network ip within same machine

[Antony Stone]

On Thursday 20 June 2002 2:14 pm, Sathi wrote:

> Hello All,
>
> I have a Redhat linux box with two NIC which i am going to use as firewall
> machine.
>
> Foe some reason i want to assign a ip address for these 2 NIC in same
> network say
>
> eth0: 10.10.10.1/24----------> to router
> eth1: 10.10.10.2/24<---------- from client

Why do you want to do this ?

What do you expect the routing table to look like on the machine (eg where 
should it send a packet for 10.10.10.10 - out of eth0 or eth1 ?)

What is your router expecting to find connected to it ?   Does it expect to 
see all 10.10.10.0/24 hosts connected on a local LAN (in which case it's 
epxecting to see arp responses for those addresses), or is it expecting to 
see them on the other side of a router (such as your firewall box) ?

Do you know what a network bridge is ?   Have you considered whether this is 
what you need ?


The setup you have proposed is not a good network configuration to work with, 
and is not recommended unless you (a) really know what you're doing, and (b) 
don't mind debugging and troubleshooting being quite difficult.

 

Antony.

RE: need to forward req between same network ip within same machine

[James Mello]

> Do you know what a network bridge is ?   Have you considered 
> whether this is 
> what you need ?

Just as a side note. There are transparent (i.e. bridging) firewalls out
there. Ipfw on FreeBSD being an example. While not for the faint of
heart it would be nice to see this kind of functionality with iptables
in the future.

	-- Cheers
	-- James

Re: need to forward req between same network ip within same machine

[Sathi]

> On Thursday 20 June 2002 2:14 pm, Sathi wrote:
>
> > Hello All,
> >
> > I have a Redhat linux box with two NIC which i am going to use as
firewall
> > machine.
> >
> > Foe some reason i want to assign a ip address for these 2 NIC in same
> > network say
> >
> > eth0: 10.10.10.1/24----------> to router
> > eth1: 10.10.10.2/24<---------- from client
>
> Why do you want to do this ?

I will be replacing this 10.10.10.0/24 address to public ip
eth1 has aliase of 172.16.0.0/16 LAN address.(This will be Masquerade to
public ip of eth0 which is working fine now)

I need to assign public ip address to some machine behind the firewall.

>
> What do you expect the routing table to look like on the machine (eg where
> should it send a packet for 10.10.10.10 - out of eth0 or eth1 ?)
>

It should go through eth0

> What is your router expecting to find connected to it ?   Does it expect
to
> see all 10.10.10.0/24 hosts connected on a local LAN (in which case it's
> epxecting to see arp responses for those addresses), or is it expecting to
> see them on the other side of a router (such as your firewall box) ?
>

It is expected to see all 10.10.10.0/24 address

> Do you know what a network bridge is ?   Have you considered whether this
is
> what you need ?
>
> The setup you have proposed is not a good network configuration to work
with,
> and is not recommended unless you (a) really know what you're doing, and
(b)
> don't mind debugging and troubleshooting being quite difficult.
>
>
>
> Antony.

Thanks
Sathi

Re: need to forward req between same network ip within same machine

[Antony Stone]

On Friday 21 June 2002 5:17 am, Sathi wrote:

> > > For some reason i want to assign a ip address for these 2 NIC in same
> > > network say
> > >
> > > eth0: 10.10.10.1/24----------> to router
> > > eth1: 10.10.10.2/24<---------- from client
> >
> > Why do you want to do this ?
>
> I will be replacing this 10.10.10.0/24 address to public ip
> eth1 has aliase of 172.16.0.0/16 LAN address.(This will be Masquerade to
> public ip of eth0 which is working fine now)

I'm not quite sure if you're saying here that you will be changing the 
10.10.10.0/24 network range for some other address range at soem stage - in 
which case I recommend that you do it now and save yourself a lot of 
networking / routing problems.

If that's not what you're saying, then what is the relevance of the 
172.16.0.0/16 address ?   If this is another internal LAN range then you 
should use that in order to avoid the nasty network / routing problems.

Basically I am saying that you should have two different network ranges on 
the two sides of the firewall.   Is there any good reason you cannot do this ?

> I need to assign public ip address to some machine behind the firewall.

That is fine - just a few simple DNAT rules...

> > What is your router expecting to find connected to it ?   Does it expect
> > to see all 10.10.10.0/24 hosts connected on a local LAN (in which case
> > it's expecting to see arp responses for those addresses), or is it
> > expecting to see them on the other side of a router (such as your
> > firewall box) ?
>
> It is expected to see all 10.10.10.0/24 address

In that case you cannot use your firewall as a router - it will have to be 
either a bridge (which I cannot really help you with - I know it can be done 
but I have no experience of it myself), or you will have to proxy arp for all 
the 10...... addresses and put a different network range on the other side of 
the firewall (as recommended above).

 

Antony.