Hello Daniel & John,
Thank you very much for your replies. Kudos to both of you for somehow interpreting the garbled ASCII art. It is the result of composing an "HTML format" email in Outlook '03.
I created a small subnet of /29 bits subnet mask for the DMZ and added the IPs of the machines in the DMZ to the outside interface of the firewall. I used DNAT & restricted access to only the intended services on those machines. Everything worked well. Thank you for the prompt replies.
Best Regards,
Deepak Seshadri
----- Original Message -----
From: Daniel Chemko
To: Deepak Seshadri ; netfilter@xxxxxxxxxxxxxxxxxxx
Cc: Imran Bashir ; Veena Rao ; Syed Amjad Ali ; Zia Ullah
Sent: Monday, October 04, 2004 2:09 PM
Subject: RE: DMZ Question
You ASCII arts looks like death!
In order to 'bind' any number of DNAT addresses to the firewall, you
have two choices.
1. Actually bind the IP address to the physical interface, such as:
ip addr add w.x.y.z/24 dev eth1
This will then get the DNAT from iptables.
iptables -t nat -A PREROUTING --destination w.x.y.z -j DNAT --to
${My_NEW_ADDR}
2. ProxyARP the IP address (http://www.sjdjweis.com/linux/proxyarp/):
echo 1 > /proc/sys/net/ipv4/conf/eth1/proxy_arp
echo 1 > /proc/sys/net/ipv4/conf/eth0/proxy_arp
This will then get the DNAT from iptables.
iptables -t nat -A PREROUTING --destination w.x.y.z -j DNAT --to
${My_NEW_ADDR}
There is one to catch when doing this. If you have a single DNS source
for external and internal machines, you'll have to resolve the machine's
ip's the external IP. Netfilter will not work performing what I call
reflective nat out of the box.
I consider reflective nat to be when you want to connect to a machine on
your subnet but under a different IP address.
# You should have something like this line already
iptables -t nat -A PREROUTING --destination w.x.y.z -j DNAT --to
${My_NEW_ADDR}
# Allow traffic to bounce off the interface
iptables -A FORWARD -o ${IF_DMZ} -o ${IF_DMZ} -j ACCEPT
# Force the firewall to rewrite the source IP of the packet since
conntrack refuses to allow SRC->FW->DST->SRC flows
iptables -t nat -A POSTROUTING --destination ${My_NEW_ADDR} --source
${DMZ_NET}/${DMZ_MSK} -j SNAT --to ${FW_DMZ_IP}
