On Friday 2005-August-12 17:41, Scott Phelps wrote:
> I have the following setup:
>
> LAN
> |
> |
> if0 ________
> DMZ---if1 if2---|ROUTER|---INTERNET
> \ / --------
> br0
FWIW I think the ASCII drawing made perfect sense. I suspect MUA or
perhaps MTA/MDA issues on Jan's part.
> LAN_NET = 10.0.0.1
> PUBLIC_NET = 77.25.33.0/28
> (14 hosts - broadcast = .15)
BTW I have a site which is using the broadcast IP for a host. You can
get away with that if you aren't using anything on that subnet which
needs broadcast. For example: DHCP, SMB. Hosts on the DMZ might answer
pings of the broadcast IP, but that's a minor inconvenience.
> I am doing transparent bridging between
> if1 and if2
>
> My ROUTER ethernet iface has IP 77.25.33.1
>
> my DMZ hosts will have public IPs ranging
> 77.25.33.2-14
>
> My question is can Masquerade (SNAT) my LAN
> IPs and use the ROUTER ethernet IP
> as a --to-source target?
What will happen to the reply packets? If the router is doing the SNAT
it should work fine. But if it's the machine with the bridge, no. The
router will receive and drop those replies.
> Or do I have to assign a IP to my br0 interface?
That would work. Or have the bridge machine SNAT to 10.0.0.1, then do
another layer of SNAT at the router. In either case the router has to
have a route to 10.0.0.0/$NETMASK.
I take it you're feeling cramped with IP addresses in the /28. That's
why I suggested using your broadcast IP. (I have tried setting the
"-nobroadcast" option with ifconfig(8), but it fails.)
> I am in deign mode so I was trying to figure out
> if this is possible.
Try it out, but I think you need that IP on the bridge.
--
mail to this address is discarded unless "/dev/rob0"
or "not-spam" is in Subject: header
