Hello, I appreciate all the comments, Let's keep it up. I promise I'll post the whole thing when I have it all figured out. My mental picture is slowly filling out. Three specific things I've got to know though: (diagrams are just for reference) > > LAN > > | (172...) > > | (eth1) > > _/\__/\_ +---+----+ _/\__/\_ > > / \ (63...) | | (204...) / \ > > ( Internet )-----------+ Router +----------( Internet ) > > \_ __ _/ (eth0) | | (eth2) \_ __ _/ > > \/ \/ +----+---+ \/ \/ > > (eth3)| 63.. > > | 204.. > > | > > --+---------------+----------+-- <---single physical > > | | net > > | | (i.e. one hub) > > | | > > +---+---+ 63..1 +---+---+ 63..2 > > | Linux | 63..4 | Linux | 63..3 > > +-------+ 204..1 +-------+ 204..2 > > 204..4 204..3 .---------------------------------------------------------------. |Version| IHL |Type of Service| Total Length | |-------+-------+---------------+-------------------------------| | Identification |Flags| Fragment Offset | |---------------+---------------+-------------------------------| | Time to Live | Protocol | Header Checksum | |---------------+---------------+-------------------------------| | Source Address | |---------------------------------------------------------------| | Destination Address | `---------------------------------------------------------------' 1. If I modify the TOS field on incomming packets with IPchains, and then route those packets to the proper internal server on my protected network, when that server replies, what do the TOS fields in the reply packets look like? Are they copies of the ones that came from the outside initiating the connection routed through my router? (I hope that's the case) Or does the kernel on the replying machine invent some new TOS value for those packets? 2. On a machine with two IP addresses on the same nic (A and B). If someone on the internet makes a connection to IP address A. What is the source address of reply packets in the IP header diagram above? A? (I hope that's the case too.) 3. Finally, is it necessary for the router box above to have two addresses on the internal network. Does it matter that the default gateway that packets, having a 204.. source address, go to might be a 63.. address? (or vice versa, as long as all machines are connected to the same physical network) If it doesn't then there is no need for a second IP address on the internal side of the router (eth3 above). If it does matter, can I put in some fancy next-hop routes on the servers based on what the source address of reply packets ends up being? (This would essentially completely ignore the default route) Something to remember (it may or may not matter to you): Valid packets coming in on eth2 (204... above) will have a 204... destination address. Also Valid packets coming in on eth0 (63... above) will have a 63... destination address. Marking the packets as they come in is merely so that we can route them back on the same interface they came in on. I don't want assymetric routes. Here's some more ascii art: local process | ^ eth0 \ | | / eth0 eth1 | | | | eth1 eth2 +--incomming | | outgoing--+ eth2 eth3 | packets | | packets | eth3 etc. / | | \ etc. | | | ^ | | | | | | | | | ---------------------------|-|-----------------(lo interface)<----| | | | | | | V V | _______ _______ | ---> C --> S --> ______ --> D --> ~~~~~~~~ -->|forward|---->| |------- h a |input | e {Routing } |Chain | |output |ACCEPT e n |Chain | m {Decision} |_______| --->|Chain | c i |______| a ~~~~~~~~ | | ->|_______| k t | s | | | | | s y | q local v | | | u | V e process DENY/ | | v m | DENY/ r packets REJECT | | DENY/ | V REJECT a | | | REJECT | DENY d --------------------- | V e ----------------------------- DENY I've slightly modified the packet flow diagram from the ipchains howto according to my understanding of how things work (in other words, correct me if I'm wrong). What I want to know is what the packet looks like once it gets to the routing decision block above from a local process. (Assume that this packet is a response to a connection established from the internet. I alredy know how the source address is decided upon for connections originating from a machine. This is farely well documented on page 48 of the IP command reference, which is part of the iproute2 distribution.) I especially want to know what the source and destination addresses are at this point. I'm sure you all can see why. If not let me know and I'll clarify. Thanks again for the help and comments. -- Andrew depaan@xxxxxxxxxxxxx -------------------------------------------------------------- Want answers to life's big questions? Visit www.bibleinfo.com.