Re: Want to do NAT for internal machines

[Antony Stone <Antony@Soft-Solutions.co.uk>]

On Saturday 01 June 2002 6:59 pm, Nick Drage wrote:

> > > # Bind the IP to eth0
> > > /sbin/ifconfig eth0:1 11.22.33.55 netmask 255.255.255.0 broadcast
> > > 11.22.33.255
> >
> > A slightly outdated way of doing it, but it'll certainly do the job.
> > It's the way I still do it.
>
> Is the latest way using the "iproute2" functionality I keep hearing about?

Yup.   Archives of this mailing list will tell you how to do it.

> > It's going to forward all packets in and out of your internal machines
> > - you may as well have just plugged them straight into the Internet.  Put
> > some decent security measures on those servers, and you'll be okay.
>
> Is the any particular reason you want the Internet to contact your hosts
> directly?  Look into the concept of a DMZ, a De-Militarized Zone - you
> might be able to come up with a more security setup.

I agree.   The solution you proposed will do what you said you wanted - but 
that doesn't mean to say that it was a good idea :-)


Antony.