You ASCII arts looks like death!
In order to 'bind' any number of DNAT addresses to the firewall, you
have two choices.
1. Actually bind the IP address to the physical interface, such as:
ip addr add w.x.y.z/24 dev eth1
This will then get the DNAT from iptables.
iptables -t nat -A PREROUTING --destination w.x.y.z -j DNAT --to
${My_NEW_ADDR}
2. ProxyARP the IP address (http://www.sjdjweis.com/linux/proxyarp/):
echo 1 > /proc/sys/net/ipv4/conf/eth1/proxy_arp
echo 1 > /proc/sys/net/ipv4/conf/eth0/proxy_arp
This will then get the DNAT from iptables.
iptables -t nat -A PREROUTING --destination w.x.y.z -j DNAT --to
${My_NEW_ADDR}
There is one to catch when doing this. If you have a single DNS source
for external and internal machines, you'll have to resolve the machine's
ip's the external IP. Netfilter will not work performing what I call
reflective nat out of the box.
I consider reflective nat to be when you want to connect to a machine on
your subnet but under a different IP address.
# You should have something like this line already
iptables -t nat -A PREROUTING --destination w.x.y.z -j DNAT --to
${My_NEW_ADDR}
# Allow traffic to bounce off the interface
iptables -A FORWARD -o ${IF_DMZ} -o ${IF_DMZ} -j ACCEPT
# Force the firewall to rewrite the source IP of the packet since
conntrack refuses to allow SRC->FW->DST->SRC flows
iptables -t nat -A POSTROUTING --destination ${My_NEW_ADDR} --source
${DMZ_NET}/${DMZ_MSK} -j SNAT --to ${FW_DMZ_IP}
