Re: Problem behind my DMZ

[Ramin Dousti <ramin@cannon.eng.us.uu.net>]

On Thu, Jan 08, 2004 at 04:16:08PM +0000, Antony Stone wrote:

> The suggestion was that if you have a large enough public IP block, you subnet 
> it so that part is used for your DMZ and part is used for everything else.   
> You can then route the DMZ subnet to machines on the DMZ which genuinely have 
> the public addresses assigned to them without using NAT.
> 
> All that is involved is to assign one of the /28 addresses to the DMZ 
> interface on your firewall, choosing the addresses for the 'external' and the 
> 'DMZ' interfaces (as well as the netmasks) so that the DMZ is a clearly 
> identified subnet of its own, with a sensible routing table entry (which gets 
> set up automatically by Linux as soon as you assign the address and the 
> netmask to the interface).
> 
> All you need to remember is that Linux consults its routing table from most 
> specific to least specific, therefore a /29 subset of a /28 will take 
> precedence over the more general /28 entry.

Dividing the /28 to 2x /29's is a waste. You can have the /28 on both the
external interface and the DMZ interface with some adjustments to the
routing table.


Let's say you have been given 192.168.1.0/28:


                            External       DMZ
ROUTER                        [eth0] FW [eth1]             SERVERS
192.168.1.1/28         192.168.1.2/28  192.168.1.2/28    192.168.1.3-14/28
                                   [eth2]
                             Internal a.b.c.d/x


Steps to take:

- Set up the IP on the FW nics:
        ip addr add 192.168.1.2/28 dev eth0   # external
        ip addr add 192.168.1.2/28 dev eth1   # DMZ
        ip addr add a.b.c.d/x      dev eth2   # internal

- Enable proxy-arp on these interfaces:
        echo 1 > /proc/sys/net/ipv4/conf/eth0/proxy_arp
        echo 1 > /proc/sys/net/ipv4/conf/eth1/proxy_arp

- Remove the local route on eth0:
        ip ro del 192.168.1.0/28 dev eth0

- Add a /32 route for the router:
        ip ro add 192.168.1.1/32 dev eth0


This should work.

Ramin



> 
> Since you have a /28 subnet (=16 addresses) it's certainly possible to do this 
> in your case, and clearly a /29 subnet for the DMZ would be the simplest 
> arrangement (although not the only one by any means).
> 
> Antony.
> 
> -- 
> It is also possible that putting the birds in a laboratory setting 
> inadvertently renders them relatively incompetent.
> 
>  - Daniel C Dennet
> 
>                                                      Please reply to the list;
>                                                            please don't CC me.
>