Grant is doing too good a job... :-) > I guess here's a Linux specific question - as opposed to the more > general IP/routing discussion we've been having. > > Given a Linux box with multiple networks on one or more interfaces > (192.168.0.1 on eth0, 192.168.5.1 on eth0:0, 172.26.0.1 on eth1, > etc.) - and just adding a "1" to /proc/sys/net/ip_forward - will > this magic box be able to forward packets between the networks > without further configuration? Since these IP's are all private you do NOT need NAT. Do NOT use NAT in this situation unless you tried plain routing and for some fancy reason, strange situation or requirement you find out you might actually need NAT here. But in your case I don't think you will come to that conclusion unless there's something you haven't told us yet (again: I don't think so). Just enable and allow all forwarding, add the routes you need and your magic box will shine like a magic lantern. :^) So, like: iptables -P FORWARD ACCEPT iptables -F FORWARD echo 1 > /proc/sys/net/ipv4/ip_forward route add -net [...etc...] No, this is not secure, but that's not what we're talking about here. This way, your box will effectively be a router. No fancy filtering, NAT-ing, whatever. > Or will this require NAT statements from iptables (and no, this is > NOT an opportunity to tell me about ipchains/ebtables/other-Linux- > networking-specialty-program-kernel- interface-I-didn't-mention)? No, it will NOT. > Ok fine - if you can recommend a tool to make this easier - I'd be > delighted to hear about it. Right now my configuration tool is > firehol. Have a look at http://www.fwbuilder.org/. I'm not using it, I'm not endorsing it, don't know anything of how it builds it's ruleset, etc. It just looks nice if you're coming from MS ISA and you might actually find it handy. Grts, Rob -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
