Hi Bert! It seems he has got a ?.?.?.160/27 net and there .161 is the gateway. He may add a firewall with two ethernet interfaces (like .162 and .163) and there all computers behind the firewall uses .163 as default gateway. There is no reason for the computers behind the firewall to be able to talk to the ISP gateway (.161) (except for testing the firewall). To use this: Tell the ISP gateway (.161) to route all packets to .162. Tell all local computers to use .163 as default gateway. On the firewall computer: # Route to the ISP gateway ip route add 10.1.1.161 src 10.1.1.162 dev eth0 proto kernel table main # Route .160/27 to local network ip route add 10.1.1.160/27 dev eth2 table main # Default route ip route add 0.0.0.0/0 dev eth1 table main # Flush cache ip route flush cache Regards, Daniel > -----Ursprungligt meddelande----- > Från: lartc-admin@xxxxxxxxxxxxxxx > [mailto:lartc-admin@xxxxxxxxxxxxxxx]För bert hubert > Skickat: Wednesday, October 25, 2000 6:26 PM > Till: Linux Advanced Routing and Trafic Control > Ämne: Re: [LARTC] Packet rewriting > > > On Wed, Oct 25, 2000 at 03:31:00PM +0200, Fredrik Rambris wrote: > > > [Internet]--[UU-Router.161]--[Firewall.162] > > I want to be able to put a machine behind the firewall on a public > > IP-adress (.163) but still protected by the firewall. I was told that > > this could be done in other firewalls by aliasing the NIC on the outside > > Are you very sure that have not been given yet another net, and > that this is > only the uplink LAN? The regular arrangement is to have two nets, and your > .162 machine in both of 'em. > > If you really only have one net, you need to do proxy arp for a > subnet. This > means that 162 will pretend to be all computers. You also need an extra > ethernet card. > > > Is this possible with ipchains and some fancy packetrewriting? > > You're note really rewriting packets, you're just passing them > around. I've > built a setup like this and it works. > > However, I'm not sure how you setup proxy arp in 2.2. There might be three > ways: > > 1) 'arp' > 2) 'ip neigh' > 3) '/proc/something/proxy_arp' > > 1) Used to work but I seem to remember that it is now deprecated > 2) may work even if 1) doesn't > 3) may be the 'new wave', but I'm not sure how it works. > > Regards, > > bert hubert > > -- > PowerDNS Versatile DNS Services > Trilab The Technology People > 'SYN! .. SYN|ACK! .. ACK!' - the mating call of the internet > > _______________________________________________ > LARTC mailing list / LARTC@xxxxxxxxxxxxxxx > http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://ds9a.nl/2.4Routing/
