On Tuesday 2005-October-25 17:03, Daniel Frederiksen wrote: > Well, yes my ISP has assigned me the two "classes", however the > a.b.c.d/30 is a single IP through which the e.f.g.h/26 are routed > through. The ISP is not routing the e.f.g.h/26 directly to the line, > but through the single WAN IP a.b.c.e/30.. > This is why all traffic going through is touched and marked as coming > from the WAN instead of the External IP address. What you describe sounds like NAT. Your gateway should be forwarding that traffic with the source IP unchanged. Can you show us tcpdump or iptables -j LOG of some of these packets' source IP being changed? I think we are missing part of the picture here. iptables-save; ip r l; ip ru l; ip a l # all those might help. Munge consistently if you feel compelled to munge. > >>>>NB: Small diagram of the setup. > >>>> > >>>> DMZ GW/FW ISP/Internet > >>>>----------------------------------------------------------------- > >>>>------ Server #1 --| > >>>> e.f.g.h3/26 | > >>>> > >>>> |---- Gateway/Firewall --- ISP WAN IP: a.b.c.d/30 > >>>> > >>>> Server #2 --| a.b.c.d1/30 Ext. IP: e.f.g.h/26 > >>>> e.f.g.h4/26 e.f.g.h1/26 "DMZ" implies there is a separate subnet, and perhaps a SNAT'ed LAN, correct? You have 3 interfaces: internal, DMZ and external? Whether or not there is an internal doesn't directly affect this, but anyway, that is how I would set it up. Your DMZ machines should have e.f.g.h1 as their default gateway. Your router machine should have whatever the ISP told you to use as its default gateway (probably a.b.c.d2, I bet.) -- mail to this address is discarded unless "/dev/rob0" or "not-spam" is in Subject: header _______________________________________________ LARTC mailing list LARTC@xxxxxxxxxxxxxxx http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc