On Tuesday 2005-October-25 17:03, Daniel Frederiksen wrote:
> Well, yes my ISP has assigned me the two "classes", however the
> a.b.c.d/30 is a single IP through which the e.f.g.h/26 are routed
> through. The ISP is not routing the e.f.g.h/26 directly to the line,
> but through the single WAN IP a.b.c.e/30..
> This is why all traffic going through is touched and marked as coming
> from the WAN instead of the External IP address.
What you describe sounds like NAT. Your gateway should be forwarding
that traffic with the source IP unchanged. Can you show us tcpdump or
iptables -j LOG of some of these packets' source IP being changed?
I think we are missing part of the picture here. iptables-save; ip r l;
ip ru l; ip a l # all those might help. Munge consistently if you feel
compelled to munge.
> >>>>NB: Small diagram of the setup.
> >>>>
> >>>> DMZ GW/FW ISP/Internet
> >>>>-----------------------------------------------------------------
> >>>>------ Server #1 --|
> >>>> e.f.g.h3/26 |
> >>>>
> >>>> |---- Gateway/Firewall --- ISP WAN IP: a.b.c.d/30
> >>>>
> >>>> Server #2 --| a.b.c.d1/30 Ext. IP: e.f.g.h/26
> >>>> e.f.g.h4/26 e.f.g.h1/26
"DMZ" implies there is a separate subnet, and perhaps a SNAT'ed LAN,
correct? You have 3 interfaces: internal, DMZ and external? Whether or
not there is an internal doesn't directly affect this, but anyway, that
is how I would set it up.
Your DMZ machines should have e.f.g.h1 as their default gateway. Your
router machine should have whatever the ISP told you to use as its
default gateway (probably a.b.c.d2, I bet.)
--
mail to this address is discarded unless "/dev/rob0"
or "not-spam" is in Subject: header
_______________________________________________
LARTC mailing list
LARTC@xxxxxxxxxxxxxxx
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
