RE: Masqueraded static IPs

Thomas Svenson
Fri, 23 Jan 2004 21:04:24 -0000

Tom Eastep wrote:
>> Is there any way I can configure Shorewall not to do so?
>>
>
> I suspect that you have something like this:
>
> 	/etc/shorewall/proxyarp
>
> 		206.124.146.177	eth1	eth0	Yes

Except I have No under HAVEROUTE

> 	/etc/shorewall/masq
>
> 		eth0	eth1	206.124.146.176

Yes.

> And when 206.124.146.177 connects to an internet host, the source
> address is 206.124.146.176 -- is this correct?

Yes, that is what other machines think is that machines IP number.

> If so, change your /etc/shorewall/masq entry to:
>
> 	eth0	<subnet>	206.124.146.176

Before I do that I just want to check. Can I still have No as HAVEROUTE
then?

> Where <subnet> is the RFC1918 subnet that resides off of eth1.
>
> Or, if there is no such subnet just remove the
> /etc/shorewall/masq entry all together. In that case, the entry in
> /etc/shorewall/masq is probably there

I use a RFC1918 subnet there, even though all machines on the "inside"
have
static IP.

> because you refused to believe the documentation when it said
> that the sample
> configurations and QuickStart guides only work correctly when you
> have a single public IP address.

Hm, must have missed/forgot that paragraph :)

Thanks Tom,
/Thomas