I''m not sure of what you want but here is an example: (Assuming local net is 10.0.0.160/27) # Accept icmp (for example ping) ipchains -A output -p icmp -j ACCEPT # Deny TCP sessions to local network (that is noone outside # the firewall may access web, ftp,... at your local net) # (Note the -y option) ipchains -A output -p tcp -d 10.0.0.160/27 -y -j DENY # Accept any TCP packets to local network ipchains -A output -p tcp -d 10.0.0.160/27 -j ACCEPT # Maybe you want some UDP ports open # Accept port 4000/UDP to local network ipchains -A output -p udp -d 10.0.0.160/27 4000 -j ACCEPT # Deny anything else to local network ipchains -A output -d 10.0.0.160/27 -j DENY Regards, Daniel> -----Ursprungligt meddelande----- > Från: lartc-admin@mailman.ds9a.nl > [mailto:lartc-admin@mailman.ds9a.nl]För Fredrik Rambris > Skickat: Wednesday, October 25, 2000 3:31 PM > Till: Linux Advanced Routing and Trafic Control > Ämne: [LARTC] Packet rewriting > > > Hello > > Now here''s a problem I''ve never thought of before. > > We have been given a net from UUNET. The first IP-address (.161) is used > by their router (which we have no access to fiddle with). I have > installed a firewall at .162 which will serve both as firewall and > trafic controller. My question is how to I make the public IP-addresses > accessible from the outside and still be located behind the firewall? > Like this > > [Internet]--[UU-Router.161]--[Firewall.162] > I want to be able to put a machine behind the firewall on a public > IP-adress (.163) but still protected by the firewall. I was told that > this could be done in other firewalls by aliasing the NIC on the outside > to all public ip-addresses and then have the firewall forward these > packets to a computer on the inside. Like portforwarding but a whole > machine (all ports) on all protocols (under IP ofcause) (not blocked by > the firewall). > > Is this possible with ipchains and some fancy packetrewriting? > > Anyone have any tips? > -- > Admera Solution Provider AB > Tel: 0733-850 814 > Position: 55°36´13N 13°03´36E
On Wed, Oct 25, 2000 at 03:31:00PM +0200, Fredrik Rambris wrote:> [Internet]--[UU-Router.161]--[Firewall.162] > I want to be able to put a machine behind the firewall on a public > IP-adress (.163) but still protected by the firewall. I was told that > this could be done in other firewalls by aliasing the NIC on the outsideAre you very sure that have not been given yet another net, and that this is only the uplink LAN? The regular arrangement is to have two nets, and your .162 machine in both of ''em. If you really only have one net, you need to do proxy arp for a subnet. This means that 162 will pretend to be all computers. You also need an extra ethernet card.> Is this possible with ipchains and some fancy packetrewriting?You''re note really rewriting packets, you''re just passing them around. I''ve built a setup like this and it works. However, I''m not sure how you setup proxy arp in 2.2. There might be three ways: 1) ''arp'' 2) ''ip neigh'' 3) ''/proc/something/proxy_arp'' 1) Used to work but I seem to remember that it is now deprecated 2) may work even if 1) doesn''t 3) may be the ''new wave'', but I''m not sure how it works. Regards, bert hubert -- PowerDNS Versatile DNS Services Trilab The Technology People ''SYN! .. SYN|ACK! .. ACK!'' - the mating call of the internet
Hi Bert! It seems he has got a ?.?.?.160/27 net and there .161 is the gateway. He may add a firewall with two ethernet interfaces (like .162 and .163) and there all computers behind the firewall uses .163 as default gateway. There is no reason for the computers behind the firewall to be able to talk to the ISP gateway (.161) (except for testing the firewall). To use this: Tell the ISP gateway (.161) to route all packets to .162. Tell all local computers to use .163 as default gateway. On the firewall computer: # Route to the ISP gateway ip route add 10.1.1.161 src 10.1.1.162 dev eth0 proto kernel table main # Route .160/27 to local network ip route add 10.1.1.160/27 dev eth2 table main # Default route ip route add 0.0.0.0/0 dev eth1 table main # Flush cache ip route flush cache Regards, Daniel> -----Ursprungligt meddelande----- > Från: lartc-admin@mailman.ds9a.nl > [mailto:lartc-admin@mailman.ds9a.nl]För bert hubert > Skickat: Wednesday, October 25, 2000 6:26 PM > Till: Linux Advanced Routing and Trafic Control > Ämne: Re: [LARTC] Packet rewriting > > > On Wed, Oct 25, 2000 at 03:31:00PM +0200, Fredrik Rambris wrote: > > > [Internet]--[UU-Router.161]--[Firewall.162] > > I want to be able to put a machine behind the firewall on a public > > IP-adress (.163) but still protected by the firewall. I was told that > > this could be done in other firewalls by aliasing the NIC on the outside > > Are you very sure that have not been given yet another net, and > that this is > only the uplink LAN? The regular arrangement is to have two nets, and your > .162 machine in both of ''em. > > If you really only have one net, you need to do proxy arp for a > subnet. This > means that 162 will pretend to be all computers. You also need an extra > ethernet card. > > > Is this possible with ipchains and some fancy packetrewriting? > > You''re note really rewriting packets, you''re just passing them > around. I''ve > built a setup like this and it works. > > However, I''m not sure how you setup proxy arp in 2.2. There might be three > ways: > > 1) ''arp'' > 2) ''ip neigh'' > 3) ''/proc/something/proxy_arp'' > > 1) Used to work but I seem to remember that it is now deprecated > 2) may work even if 1) doesn''t > 3) may be the ''new wave'', but I''m not sure how it works. > > Regards, > > bert hubert > > -- > PowerDNS Versatile DNS Services > Trilab The Technology People > ''SYN! .. SYN|ACK! .. ACK!'' - the mating call of the internet > > _______________________________________________ > LARTC mailing list / LARTC@mailman.ds9a.nl > http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO:http://ds9a.nl/2.4Routing/