Re: Masqueraded static IPs

Tom Eastep
Fri, 23 Jan 2004 20:49:37 -0000

On Friday 23 January 2004 12:34 pm, Thomas Svenson
wrote:
> Hi List,
>
> I''m using the proxyarp feature in Shorewall to keep using static
IPs from
> machines inside the firewall.
>
> However, they all get announced with the firewall IP number it looks like.
>
> I know it could be a good thing to not expose their real IP-numbers and I
> haven''t noticed any problems with it. I would though like to
control this
> myself and be able to set if one/several machine(s) should be masqueraded
> or not.
>
> Is there any way I can configure Shorewall not to do so?
>

I suspect that you have something like this:

	/etc/shorewall/proxyarp

		206.124.146.177	eth1	eth0	Yes

	/etc/shorewall/masq

		eth0	eth1	206.124.146.176


And when 206.124.146.177 connects to an internet host, the source address is
206.124.146.176 -- is this correct?

If so, change your /etc/shorewall/masq entry to:

	eth0	<subnet>	206.124.146.176

Where <subnet> is the RFC1918 subnet that resides off of eth1.

Or, if there is no such subnet just remove the /etc/shorewall/masq entry all
together. In that case, the entry in /etc/shorewall/masq is probably there
because you refused to believe the documentation when it said that the sample
configurations and QuickStart guides only work correctly when you have a
single public IP address.